Re: SSL Certificate Beginner Question

[Chris Lear]

* Bill Barker wrote (30/11/05 05:42):
> "Scott Purcell" <[EMAIL PROTECTED]> wrote in message 
> news:[EMAIL PROTECTED]
>> Real helpful ... I searched on SRV.12 and it brought up a bunch of links
>> that have nothing to do with Tomcat  config of SSL.
>>
>> I probably posted a lame request. Let me try again.
>>
>> I have purchased a certificate via Verisign, and I have installed the
>> certificate into a keystore. I am running Windows XP and Tomcat 5.5.12.
>> I put the keystore and Cert.cer in the Tomcat/bin directory for 
>> organiation.
>> I read that the default is usually in the home directory where tomcat is
>> installed on Unix. But that is another OS.
>>
>> I followed the docs here under Tomcat 5 SSL and ran across this:
>> http://tomcat.apache.org/tomcat-5.5-doc/ssl-howto.html
>>
> 
> There are two likely problems, but I don't know which one applies to you.
> 
> 1) Since you are using 5.5.12, if you installed the libtcnative.dll with 
> Tomcat, then you need to configure SSL via 
> http://tomcat.apache.org/tomcat-5.5-doc/apr.html.  In particular, you need 
> to extract the private-key into an OpenSSL format.  Alternatively, you can 
> rename the dll for now, and work on just getting the Java Connector working.
> 
> 2) You imported your cert into a different keystore file than the one that 
> use used to generate the CSR.  Import the cert into the original one and you 
> will be fine.  If you used OpenSSL to generate the CSR, than the easiest is 
> to convert to a pkcs12 keystore as described above.  Alternatively, you can 
> try using http://www.comu.de/docs/tomcat_ssl.htm.
> 

3) (Maybe a long shot) Windows xp firewall is blocking the port. Does
netstat -ln show anything listening on port 8443? Do the tomcat logs
mention port 8443?

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Apache 2.2 and mod_proxy_ajp

[Chris Lear]

* Jess Holle wrote (02/12/05 13:53):
> I have some vague recollection that performance of mod_proxy_ajp tested 
> just /slightly /better than mod_jk.

But where is the information on this?

I joined this list a few days ago after Googling like crazy for
information on the most sensible and supported way to connect apache to
tomcat (or whether to drop it and just use the http connector). In the
end, I'm using mod_jk, because I couldn't find *anything* helpful on the
web about configuring or using mod_proxy_ajp, apart from some
theoretical examples that tended to be incompatibile with one another.
The only thing people seem to agree on is that mod_jk2 is no use, though
that had the option of unix sockets, which I would have thought would be
a good thing.

I might revert to using the http connector. The reasons for not doing
this are: 1) I want apache to do SSL, 2) I don't want to run tomcat as
root, and using local port forwarding is a hassle, and 3) there's a bit
more flexibility in the apache route.

Chris


> 
> Tim Funk wrote:
> 
>> Performance (IIRC while reading on the mailing lists) is about the 
>> same. mod_proxy_ajp should be easier to configure and install since it 
>> comes bundled with apache and it should be much easier to install than 
>> jk.

>>
>> -
>> To unsubscribe, e-mail: [EMAIL PROTECTED]
>> For additional commands, e-mail: [EMAIL PROTECTED]
> 
> 


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Problems ip based virtual hosting apache2+tomcat5.0.19

[Chris Lear]

* Jens Werdin wrote (14/12/05 15:28):
> Hi all,
> 
> I have an apache 2.0.49 with some ip based virual hosts.
> What i try to do is giving each virtual host its own webapplication.
> 
> Apache and tomcat are working. its working if I try with localhost.
> when i try the ip address of a virtual hosts i always get the answer.
> "no host matches server name 192."
> What i tried so far is configuring a worker for each host, a connector for 
> each worker and a host with name="192." 
> 
> in detail:
> worker.worker4.host=192.168.2.124
> worker.worker4.port=8124
> 
> 
> 
> 

Try something like this rather abbreviated example:



















Warning: not tested. I've only ever used one service in each tomcat
instance. I run a different tomcat instance for each IP address.

Tomcat needs the defaultHost to be set, or it tends to refuse to talk
when no name matches. Getting different defaults for different IP
addresses will need separate services. You could run them on the same IP
address but different ports instead of different addresses - it would
come to the same thing.

Chris

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: multiple Tomcat5 service-how

[Chris Lear]

* Chris Pat wrote (14/12/05 17:25):
> Hello
> I have three sites I want to publish w/cc transactions
> with Tomcat5.  Is it possible to do it with one
> installation of TC and three separate certificates and
> three separate static IPs?  
> 
> I assume I would create three Services.  However I
> cannot see where to hardcode in the specific IP and
> where designate a different webapps directory for each
> Service.  

The IP address goes into the connector. It's called address. The webapps
directory is set in the host. It's called appBase. Have a look at
http://tomcat.apache.org/tomcat-5.5-doc/config/ for all the options.

eg:

  
  
  
  
  
  

  
  
  
  
  
  


Chris

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Problem with JK connector

[Chris Lear]

* Chris Mooring wrote (18/01/06 15:11):
> Hi Michael,
> 
> Could it be that your request headers are > 8K ? I was having some funny
> issues with JK2 this week where my page would suddenly show some sort of c
> stack trace about a BufferOverFlow Exception (we are no longer using JK2),
> but someone sent me this information;
> 
> "It looks like requests can only be 8k long:
> 
> 
> What happens if the request headers > max packet size? There is no provision
> to send a second packet of request headers in case there are more than 8K (I
> think this is correctly handled for response headers, though I'm not
> certain). I don't know if there is a way to get more than 8K worth of data
> into that initial set of request headers, but I'll bet there is (combine
> long cookies with long ssl information and a lot of environment variables,
> and you should hit 8K easily). I think the connector would just fail before
> trying to send any headers in this case, but I'm not certain.
> 
> http://tomcat.apache.org/tomcat-5.0-doc/catalina/docs/api/constant-values.ht
> ml#org.apache.ajp.Ajp13.MAX_READ_SIZE
> "

I would like to know whether a) request headers really are limited like
this, and b) there's anything I can do about it.

We have a web application running under tomcat, and we're using quite a
lot of Ajax code, which sends user data to the server via xmlhttp. I've
noticed that when using ajp the POST data is corrupted if there is a lot
of data (it's rare in practice, but quite recreatable). Without ajp,
this doesn't happen. However, it's perfectly possible to upload a large
file via a web form using ajp.

If I switch to accessing tomcat directly (and this is easy, because I
have tomcat on port 8080, and apache on port 80 forwarding to exactly
the same tomcat instance) the large POSTs work fine, so I don't think
there's anything wrong with the application.

Does anyone know any more about this? I'm prepared to dump ajp, but I
quite want to keep it if possible, because running apache is convenient
for a variety of reasons.

Chris

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: how to configure the tomcat 5.5.12 for a port 80 in linux (Gentoo)??

[Chris Lear]

* Dhaval Patel wrote (19/01/2006 02:13):
> Hi,
> 
>For detail information about the problem and solution, visit:
> http://wiki.apache.org/tomcat/HowTo#head-18d1c3f3fa702a1be769340784515eecce6e0ac9

Also see http://tomcat.apache.org/tomcat-5.0-doc/setup.html for info on
jsvc. You'd have to replace /etc/init.d/tomcat with something like the
bundled Tomcat.sh file (appropriately tweaked)

> 
>The quick solution is to to administer (start, stop, edit) tomcat only as 
> a root.

And the way to do that in Gentoo is to edit /etc/conf.d/tomcat and
change the CATALINA_USER variable. But don't do it unless you don't mind
people having a go at you for misadministration of a linux machine.

Chris

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: How to do the precompilation on jsp

[Chris Lear]

* Raju Balugu wrote (03/08/06 10:14):

Hi All,

We are using the clearcase for version control(vob).My requirement is
like..I need to do the precompilation before going to ran a build?is there
any utilities in  tomcat  end or third partys.(as the jasper-compiler is so
fast we are palning to do this).please share your experience on precompile
the jsp files


There's an ant task for this (if I've understood you). See 
http://tomcat.apache.org/tomcat-4.1-doc/jasper-howto.html#Web%20Application%20Compilation


Chris

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: How to do the precompilation on jsp

[Chris Lear]

* Chris Lear wrote (03/08/06 11:48):

* Raju Balugu wrote (03/08/06 10:14):

Hi All,

We are using the clearcase for version control(vob).My requirement is
like..I need to do the precompilation before going to ran a build?is there
any utilities in  tomcat  end or third partys.(as the jasper-compiler is so
fast we are palning to do this).please share your experience on precompile
the jsp files


There's an ant task for this (if I've understood you). See 
http://tomcat.apache.org/tomcat-4.1-doc/jasper-howto.html#Web%20Application%20Compilation


Or, slightly more up to date:
http://tomcat.apache.org/tomcat-5.5-doc/jasper-howto.html#Web%20Application%20Compilation

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: multiple instances of tomcat

[Chris Lear]

* Pratap Parne wrote (03/08/06 15:50):

how to setup and deploy applications on multiple
instances of tomcat on a single box.can anyone give me
the steps to do that


You need to use different CATALINA_BASE variables for the different 
instances. It's badly documented (in my opinion), but you can try here:


http://www.google.co.uk/search?q=+site%3Atomcat.apache.org+tomcat+catalina_base

And read the comments in catalina.sh (or catalina.bat)

Basically, you need to set CATALINA_BASE to a directory that contains 
directories called conf, logs, temp, and webapps. A work directory will 
be created there as well. You can have several of these.
The bin, common, server, and shared directories should all be in the 
directory that CATALINA_HOME points to. You need only one of these.


Then make sure your different tomcats don't try to bind to the same 
ports, and you're away.


Chris

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Is there a way so specify a wildcard in host/alias to avoid dealing with bunch of virtual hosts?

[Chris Lear]

* David Gagnon wrote (03/08/06 17:12):

Hi all,

  I have a lot of virtual hosts on my network.  I need all of them to 
access the same application on a tomcat 5.5.  I know there are the ALIAS 
directive in server.xml but the problem is that new virtual host may be 
added when the application is running and I don't want to manually 
manage them. So is there a way to have a host/application that will 
accept request from any virtual host?  I checked the code in Mapper.java 
and there is no use of wildcard there. 


Like:
c1.toto.com
c2.toto.com
c3.toto.com
c4.toto.com

Is there any solution ? Thanks for the help!


In server.xml something like
 
 
 
should do it.

The defaultHost tells tomcat what to do with requests to hostnames that 
aren't otherwise mapped.


Chris

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: FYI tomcat 100% load SSL

[Chris Lear]

* Oscar Mechanic wrote (07/08/06 12:04):
> For those of you who ever have this problem
> 
> Symptoms
> 
> 1) Cannot connect to tomcat after a period of time
> 2) Heavy load on startup
> 3) Various strangeness with SSL certs e.g. WEB browsers reject
> certs/incomplete TLS handshake
> 
> Observed case
> 
> Tomcat version we tried jakarta-tomcat-5.0.12 and jakarta-tomcat-5.5.17
> we are using openssl to generate certs. OS is linux 2.6.17 (Newest) on
> our own distribution. After reboot tomcat works fine modprobe random and
> we cannot connect to tomcat on SSL ports and the load goes high. 
> 
> We dont know where the problem lies i.e. in kernel/distro/tomcat/java
> but one check you might think of taking if you see similar difficulties.
> Is to reboot without random module or rmmod and restart tomcat. We also
> tried 1.4 to 1.5_02 & 1.5_06 and still the same problem.
> 
> Sorry I cant be more specific but I am behind my deadline and its
> working now. So no more /dev/random for this release. Been at this for a
> few days.

/dev/random blocks if it doesn't have enough entropy to produce
randomness. /dev/urandom doesn't, but is a bit less random as a result.
Some people link /dev/random to /dev/urandom to get round the problem.
But you can tell java to use urandom via a command-line switch
(-Djava.security.egd=file:/dev/urandom).

This could be the cause of the bug observed here. This might also be
interesting:
http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4705093

Chris

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Tomcat consuming entire CPU.

[Chris Lear]

* Mark Stevens wrote (24/07/07 11:32):

Hi all,

Sorry if this has been covered already in other posts,

I'm fishing for some tips to debug an intermittent issue with Tomcat load.

My JRE:java version "1.3.1_14"

The server is running Oracle, Tomcat, Apache 2.2 and a Content
Management System, Operating system is Solaris 8 running on sun4u Sun
Fire V240 with 4GB of RAM.


Every so often the java process for Tomcat consumes an entire CPU, and
requires Tomcat to be killed, and then restarted, this is happened
quiet load with only a couple of HTTP requests coming through every
second.

I'm wondering if this down to code, or just not having enough free
RAM, Xms and Xmx are both set to 1024M, I've heard it's not good to
set Xms too high.


Anyhow, can anyone suggest a good, and easy to use tool to profile my
webapps memory and CPU usage,  I've had a quick look at J-Profiler,
but was wondering if there were any other favorites amongst the group
users.


I experienced these exact symptoms and reported it here:
http://issues.apache.org/bugzilla/show_bug.cgi?id=42925.

Are you using sendfile (default when using Apache Portable Runtime)? 
Removing that was the workaround for me, and it's still working fine.
However, my setup is different, so it's possible that this is a red 
herring, but I might as well mention it.


You could also have a look at this thread with some different problems 
that might be more Solaris-related:


http://mail-archives.apache.org/mod_mbox/tomcat-users/200609.mbox/[EMAIL 
PROTECTED]

For debugging, I found that getting thread dumps (kill -3) worked fairly 
well, though it took me quite a while to work out how to use them. I 
could use ps or top to find that one thread was the problem, and get the 
thread id, then cross-reference that to the thread dump to find which 
thread it was. It was always sendfile, which uses native code, so I just 
removed it from the config. Problem not solved, but there you are.


Chris

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Which direction: mod_jk or mod_proxy_ajp? (was: why use mod_jk?)

[Chris Lear]

* Brad O'Hearne wrote (24/02/06 15:14):
> Josh,
> 
> Thanks a lot for your answer. I am using Apache 2.2.x. Now onto my  
> next question. Bill Barker suggested the httpd.conf / mod_proxy_ajp  
> directive side of the equation. Doesn't there have to be a connector  
> in tomcat's server.xml which will allow listening for the ajp  
> protocol? Is there documentation on this somewhere?

http://tomcat.apache.org/tomcat-5.5-doc/config/ajp.html

In fact, the http://tomcat.apache.org/tomcat-5.5-doc/config/index.html
page is a good place to go for a lot of things. I generally find tomcat
documentation hard to read and hard to understand (I find httpd.conf
much more to my taste), but it's generally possible to get there in the
end, and better than following half-baked how-tos.

The server.xml that ships with tomcat has an ajp connector by default, I
think.

By the way, I had a very similar battle getting mod_jk going, except
that once I found that mod_proxy_ajp only worked in a version of apache
I wasn't using, and that mod_jk2 was obsolete (whereas mod_jk wasn't),
and I made the choice of mod_jk, setting it up wasn't actually too bad.

However, I've found that a large POST to a web page through mod_jk can
get mangled (and the mod_jk debug log simply doesn't show chunks of it),
whereas direct to tomcat works fine. So I slightly mistrust ajp. There's
not much documentation on the protocol, and what exists suggests that
not very many people in the world really know what's going on with it.

Chris

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: what is favicon.ico? what its significance?

[Chris Lear]

* Pusukuri, Kishore_Kumar wrote (13/03/06 10:41):
> 
> what is favicon.ico? what its significance?

This link might help:

http://www.google.co.uk/search?q=favicon.ico

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Tomcat 5.5.16: strange redirecting

[Chris Lear]

* Velpi wrote (27/04/06 15:49):

Hi,

I used a fresh install of Tomcat 5.5.16 on the Windows platform to confirm what 
I was seeing:


a request to
http://localhost/manager
results in a redirect to
http://localhost/manager/?


The same thing happens with (one of) my servlets when it receives no parameters:
http://idp.example.be/shibboleth-idp/SSO
becomes
http://idp.example.be/shibboleth-idp/SSO/?
(which contains a filter that redirects with its own URL as a parameter -which 
is wrong now because of the /? -)


It is certainly new from Tomcat v5.5.12, probably first emerged in 5.5.16. Does 
anyone have a clue what causes it or how to fix it?


Might it be due to this bug?

http://issues.apache.org/bugzilla/show_bug.cgi?id=38113

The CAS SSO mechanism is broken by this. There's a one-line fix in the 
cas client code to work round it, but it looks like downgrading or 
upgrading is probably the best answer.


Chris

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Restricting access to Tomcat

[Chris Lear]

* Edward Quick wrote (28/04/06 09:09):
> Hi,
> 
> I have an Apache mod_jk Tomcat server set up on the same host, and want to 
> restrict access to the Tomcat so that only the Apache on the localhost can 
> connect to port 8009.
> 
> I tried using org.apache.catalina.valves.RemoteAddrValve, with 
> allow="127.0.0.1", but the issue is that Tomcat picks up the IP address of 
> the client, and not the Apache which is passing traffic onto it.
> 
> Is there a way round this?




Won't that do it?

Chris

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Restricting access to Tomcat

[Chris Lear]

* Edward Quick wrote (28/04/06 10:53):
> 
>> > Hi,
>> >
>> > I have an Apache mod_jk Tomcat server set up on the same host, and want 
>>to
>> > restrict access to the Tomcat so that only the Apache on the localhost 
>>can
>> > connect to port 8009.
>> >
>> > I tried using org.apache.catalina.valves.RemoteAddrValve, with
>> > allow="127.0.0.1", but the issue is that Tomcat picks up the IP address 
>>of
>> > the client, and not the Apache which is passing traffic onto it.
>> >
>> > Is there a way round this?
>>
>>
>>>address="127.0.0.1">
>>
>>Won't that do it?
>>
>>Chris
>>
> 
> I don't think so because that's saying, bind the ajp listener to the 
> localhost. It's not saying restrict access to the ajp listener to localhost.

If it's bound to the loopback interface only, then only local
applications will be able to connect to it. Nothing else can access
127.0.0.1.
Try it, and then try using
telnet i.p.add.ress 8009 from a different machine
You should get connection refused. I'm fairly confident that this solves
your problem.

Chris

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Restricting access to Tomcat

[Chris Lear]

* Edward Quick wrote (28/04/06 13:07):
>>* Edward Quick wrote (28/04/06 10:53):
>> >
>> >> >
>> >> > I have an Apache mod_jk Tomcat server set up on the same host, and 
[...]
> 
> Thanks, I know what you mean but my problem is the Apache is not on the same 
> box as the Tomcat.

Sorry. I misunderstood your original post. I thought you meant they were
on the same machine.

Chris

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Tomcat on a Memory Stick

[Chris Lear]

* Markus-Alexander Metz wrote (26/05/06 11:51):
> Hi Andrew
> 
> Thanks for your feedback. I'm running the stick under windows based systems.
> Java (jre and SDK) is also installed on the stick. You wrote:
> 
>> Why do you not define JAVA_HOME and CATALINA_HOME in the startup scripts?
> 
> This would be the solutions I was seeking. But how does this script has to
> look like? I guess I have to write a .bat file and set the environment
> variables inside. And start this .bat File by the autorun.inf.
> 
> But how has this script looks like to set the environment variables? Does
> someone has any idea, cause I'm not very familiar in writing such scripts?

Tomcat comes with a script called catalina.bat (it's in /bin), which
already guesses CATALINA_HOME. Tweak this to set JAVA_HOME as well, and
there you go.

Chris

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Separate JVM's for TOMCAT

[Chris Lear]

* [EMAIL PROTECTED] wrote (23/06/06 09:50):
> Hi ,
>  Can anyone tell me how to make two separate JVM of a single installation
> of tomcat server.
> Remember I dont want different context , but tow separate JVM , is it
> possible ?
> Or tomcat will only be the solution ?

You can use the badly-documented CATALINA_BASE environment variable.

It's mentioned on this page:
http://tomcat.apache.org/tomcat-5.5-doc/appdev/deployment.html
but the best documentation is probably in comments in the catalina.sh
script.

The way it works is reasonably straightforward. The "base" directory
contains subdirs for conf, logs, webapps, and work (and temp, normally).
CATALINA_HOME is the same for all instances, and contains subdirs for
bin, common, and shared. You can use catalina.sh (or .bat) with
different CATALINA_HOME settings to start/stop your different instances.

Chris

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Separate JVM's for TOMCAT

[Chris Lear]

* Chris Lear wrote (23/06/06 10:09):
> * [EMAIL PROTECTED] wrote (23/06/06 09:50):
>> Hi ,
>>  Can anyone tell me how to make two separate JVM of a single installation
>> of tomcat server.
>> Remember I dont want different context , but tow separate JVM , is it
>> possible ?
>> Or tomcat will only be the solution ?
> 
> You can use the badly-documented CATALINA_BASE environment variable.
> 
> It's mentioned on this page:
> http://tomcat.apache.org/tomcat-5.5-doc/appdev/deployment.html
> but the best documentation is probably in comments in the catalina.sh
> script.
> 
> The way it works is reasonably straightforward. The "base" directory
> contains subdirs for conf, logs, webapps, and work (and temp, normally).
> CATALINA_HOME is the same for all instances, and contains subdirs for
> bin, common, and shared. You can use catalina.sh (or .bat) with
> different CATALINA_HOME settings to start/stop your different instances.

I meant different CATALINA_BASE settings, of course. CATALINA_HOME
should always be the same. Sorry about that.

Chris

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]