Apache Tomcat Service Install How-To¶

Set logging.properties¶

By default with the default settings in logging.properties, Tomcat will rotate the logs and it will logs lots of stuff and it will write same log on catalina.out and catalina.log and we do not want this in production.

Replace the logging.properties file inside the conf folder of tomcat with this:

handlers = 1catalina.org.apache.juli.FileHandler

.handlers = 1catalina.org.apache.juli.FileHandler

############################################################
# Handler specific properties.
# Describes specific configuration info for Handlers.
############################################################

1catalina.org.apache.juli.FileHandler.level = FINE
1catalina.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
1catalina.org.apache.juli.FileHandler.prefix = catalina
1catalina.org.apache.juli.FileHandler.rotatable = false

############################################################
# Facility specific properties.
# Provides extra control for each logger.
############################################################

Configure a log rotate¶

Create a file into /etc/logrotate.d folder:

# touch /etc/logrotate.d/tomcat

Put this content inside the file:

/var/log/tomcat/*.log {
        copytruncate
        daily
        rotate 7
        compress
        missingok
        size 5M
}

Then create a symbolic link to the catalina.log (replace the path to the tomcat and change the name catalina.log if you need to):

ln -s /usr/local/tomcat/logs/catalina.log catalina.log

Reload the logrotate deamon:

# /usr/sbin/logrotate /etc/logrotate.conf

More on logrorate:

# man logrotate

SSL Apache Configuration¶

1. Upload files necessary for using SSL protocol into the server.

Locate the folder /etc/pki/tls create folder kspmis and put the following files:

_wildcard_kspmis_com.crt

Server certificate data file

rsa-dv.chain-bundle.pem

Server CA Certificates

_wildcard_kspmis_com_SHA256WITHRSA.key

Server private key file

You can find these files on SVN http://125.141.221.126/repo/STND_PMIS_util/etc/20160215-167040-_wildcard_kspmis_com.pfx

2. In order to use SSL verify that mod_ssl module is enabled.

• mod_ssl.so should be present in modules folder

• The following directives should be present somewhere.

  Check files inside extra folder (ex. httpd-ssl.conf) and httpd.conf.:

  LoadModule ssl_module modules/mod_ssl.so
  Listen 443
  

If the module is not present install it with:

# for Centos
yum install mod_ssl

3. Create a VirtualHost listening on port 80 that will redirect requests from *.kspmis.com to 443:

   <VirtualHost *:80>
           ServerAlias *.kspmis.com
           #ServerName kamcoybd.kspmis.com
           #ServerAlias www.kamcoybd.kspmis.com
           RewriteEngine on
           ReWriteCond %{SERVER_PORT} !^443$
           RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NE,R,L]
   </VirtualHost>
   

# This module have to be enabled
LoadModule rewrite_module modules/mod_rewrite.so

4. Modify the VirtualHost listening on port 80 as follow:

   <VirtualHost *:443>
   ...
   
   # ============ SSL CERTIFICATE HERE =============
   SSLEngine On
   SSLCertificateFile    /etc/pki/tls/kspmis/_wildcard_kspmis_com.crt
   SSLCertificateKeyFile /etc/pki/tls/kspmis/_wildcard_kspmis_com_SHA256WITHRSA.key
   SSLCertificateChainFile /etc/pki/tls/kspmis/rsa-dv.chain-bundle.pem
   # ================================================
   

5. Test the apache configuration:

   # apachectl -t
   
   [Thu Feb 25 16:04:11 2016] [warn] _default_ VirtualHost overlap on port 443, the first has precedence
   Syntax OK
   

Status Worker Manager¶

Add the following code to the workers.properties.

# Add the status worker to the worker list
worker.list=jkstatus
# Define a 'jkstatus' worker using status
worker.jkstatus.type=status

Add the following code to the directive VirtualHost inside the host configuration file.

Apache 2.2

# JK MANAGER
<Location /jkmanager/>
JkMount jkstatus
Order deny,allow
Deny from all
Allow from 127.0.0.1
</Location>

Apache 2.4

# JK MANAGER
<Location /jkmanager/>
JkMount jkstatus
#Require all denied
Require ip 127.0.0.1
</Location>

# JK MANAGER 2.2
<Location /jkmanager/>
JkMount jkstatus
Order deny,allow
Deny from all
Allow from 127.0.0.1
Allow from 200.300.20.0/24
Allow from 192.168.0.10
</Location>

# JK MANAGER 2.4
<Location /jkmanager/>
JkMount jkstatus

Require ip 127.0.0.1
Require ip 200.300.20.0/24
Require ip 192.168.0.10
</Location>