Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
|
tutorial:adm:server_preparation [2019/06/04 11:57] urbanl [Start Tomcat automatically after system startup - Debian] Selinux change on Centos |
tutorial:adm:server_preparation [2019/11/27 08:29] fiserp [HTTPd installation and configuration] |
||
|---|---|---|---|
| Line 23: | Line 23: | ||
| yum update -y | yum update -y | ||
| # other recommended packages installation | # other recommended packages installation | ||
| - | yum install -y net-tools nano wget mc vim-enhanced screen sysstat bzip2 ssmtp bash-completion lsof haveged nmap zip unzip psmisc telnet | + | yum install -y net-tools nano wget mc vim-enhanced screen sysstat bzip2 ssmtp bash-completion lsof haveged nmap zip unzip psmisc telnet |
| # enable haveged after OS start | # enable haveged after OS start | ||
| systemctl start haveged.service | systemctl start haveged.service | ||
| Line 199: | Line 199: | ||
| ===== Tomcat ===== | ===== Tomcat ===== | ||
| + | |||
| + | <note warning> | ||
| Installation - CentOS7: | Installation - CentOS7: | ||
| <code bash> | <code bash> | ||
| - | yum install -y tomcat | + | yum install -y tomcat |
| </ | </ | ||
| Line 291: | Line 293: | ||
| <code bash> | <code bash> | ||
| systemctl enable tomcat8 | systemctl enable tomcat8 | ||
| - | </ | ||
| - | |||
| - | === On CentOS turn off Selinux === | ||
| - | On CentOS in Selinux you need to allow tomcat to connect to database through network. | ||
| - | <code bash> | ||
| - | setsebool -P tomcat_can_network_connect_db true | ||
| - | </ | ||
| - | Then check it. | ||
| - | <code bash> | ||
| - | getsebool -a |grep tomcat | ||
| - | </ | ||
| - | If it's set right you will se this line with " | ||
| - | < | ||
| - | tomcat_can_network_connect_db --> on | ||
| </ | </ | ||
| ==== Apache Tomcat configuration recommended for production usage ==== | ==== Apache Tomcat configuration recommended for production usage ==== | ||
| Line 321: | Line 309: | ||
| * Make Tomcat listen only on localhost: | * Make Tomcat listen only on localhost: | ||
| * Add the '' | * Add the '' | ||
| + | * On tomcat 7 add '' | ||
| * In Debian you need to uncoment AJP conector on port '' | * In Debian you need to uncoment AJP conector on port '' | ||
| * Change logging into '' | * Change logging into '' | ||
| Line 559: | Line 548: | ||
| Again, restart the tomcat: | Again, restart the tomcat: | ||
| <code bash> | <code bash> | ||
| - | systemctl | + | service tomcat8 |
| </ | </ | ||
| ====== Apache httpd as a reverse proxy ====== | ====== Apache httpd as a reverse proxy ====== | ||
| Line 650: | Line 639: | ||
| To do so, add following lines to the virtualhost config file (ssl.conf): | To do so, add following lines to the virtualhost config file (ssl.conf): | ||
| < | < | ||
| - | | + | RewriteEngine On |
| - | RewriteRule " | + | RewriteRule " |
| </ | </ | ||
| - | In the file ssl.conf we also have to disable SSLv3. Edit the line with SSLProtocol directive: | + | We also have to secure the communication. **Edit** corresponding lines in '' |
| < | < | ||
| - | SSLProtocol all -SSLv2 -SSLv3 | + | SSLProtocol all -SSLv2 -SSLv3 |
| + | SSLCipherSuite ALL: | ||
| + | SSLHonorCipherOrder on | ||
| </ | </ | ||
| + | < | ||
| On Debian, create symlinks to sites-enabled: | On Debian, create symlinks to sites-enabled: | ||