Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
|
tutorial:adm:server_preparation_tmp [2020/07/24 08:29] fiserp [DB server configuration] |
tutorial:adm:server_preparation_tmp [2020/07/24 12:35] fiserp [Tomcat] |
||
|---|---|---|---|
| Line 142: | Line 142: | ||
| - | ==== DB server configuration ==== | + | ==== Database |
| * Enable the password authentication. | * Enable the password authentication. | ||
| Line 158: | Line 158: | ||
| * Adjust DB instance sizing. | * Adjust DB instance sizing. | ||
| - | * In following snippet, we presume the system has 3GB of memory dedicated for the database. **For your deployment, adjust the sizing accordingly. Use a [[https:// | + | * In following snippet, we presume the system has 3GB of memory dedicated for the database |
| * We also log queries running longer than 200ms. | * We also log queries running longer than 200ms. | ||
| - | In a file ''/ | + | In a file ''/ |
| < | < | ||
| - | max_connections = 100 # (change requires restart) | + | # This is an EXAMPLE. Use the calculator to adjust for your deployment! |
| - | shared_buffers = 768MB # min 128kB | + | # DB Version: 12 |
| + | # OS Type: linux | ||
| + | # DB Type: web | ||
| + | # Total Memory (RAM): 3 GB | ||
| + | # Connections num: 100 | ||
| + | # Data Storage: ssd | ||
| + | max_connections = 100 | ||
| + | shared_buffers = 768MB | ||
| effective_cache_size = 2304MB | effective_cache_size = 2304MB | ||
| - | work_mem = 7864kB | ||
| maintenance_work_mem = 192MB | maintenance_work_mem = 192MB | ||
| - | |||
| - | min_wal_size = 1GB | ||
| - | max_wal_size = 2GB | ||
| checkpoint_completion_target = 0.7 | checkpoint_completion_target = 0.7 | ||
| wal_buffers = 16MB | wal_buffers = 16MB | ||
| - | |||
| default_statistics_target = 100 | default_statistics_target = 100 | ||
| + | random_page_cost = 1.1 | ||
| + | effective_io_concurrency = 200 | ||
| + | work_mem = 3932kB | ||
| + | min_wal_size = 1GB | ||
| + | max_wal_size = 4GB | ||
| log_min_duration_statement = 200 | log_min_duration_statement = 200 | ||
| </ | </ | ||
| - | Restart | + | * Restart |
| - | < | + | < |
| + | systemctl restart | ||
| + | </ | ||
| + | |||
| + | < | ||
| ===== Java - CentOS8 ===== | ===== Java - CentOS8 ===== | ||
| - | Java must be installed | + | Tomcat application server needs Java installed. |
| Installation: | Installation: | ||
| - | < | + | < |
| - | yum install -y java-11-openjdk-headless java-11-openjdk-devel | + | dnf install -y java-11-openjdk-headless java-11-openjdk-devel |
| </ | </ | ||
| - | |||
| - | Then create the file ''/ | ||
| - | <file bash java.sh> | ||
| - | [ -d / | ||
| - | </ | ||
| Line 204: | Line 211: | ||
| < | < | ||
| groupadd -r tomcat | groupadd -r tomcat | ||
| - | useradd -r -s /bin/nologin -g tomcat -d /opt/tomcat tomcat | + | useradd -r -s /usr/sbin/nologin -g tomcat -d /opt/tomcat tomcat |
| getent passwd tomcat | getent passwd tomcat | ||
| - | # | + | # |
| </ | </ | ||
| Line 216: | Line 223: | ||
| </ | </ | ||
| - | * Download Apache Tomcat 8.5.x from the website [[https:// | + | * Download Apache Tomcat 8.5.x from the website [[https:// |
| - | * In our exapmle the version is 8.5.8. | + | * In our exapmle the version is 8.5.57. |
| - | * extract files from archive: | + | * extract files from the archive: |
| <code bash> | <code bash> | ||
| - | tar xzf apache-tomcat-8.5.8.tar.gz | + | tar xzf apache-tomcat-8.5.57.tar.gz |
| </ | </ | ||
| Line 229: | Line 236: | ||
| <code bash> | <code bash> | ||
| cd /opt/tomcat | cd /opt/tomcat | ||
| - | ln -s apache-tomcat-8.5.8 current | + | ln -s apache-tomcat-8.5.57 current |
| </ | </ | ||
| Line 239: | Line 246: | ||
| chmod 750 /opt/tomcat | chmod 750 /opt/tomcat | ||
| cd / | cd / | ||
| - | chmod o+rX -R ./ | + | chmod -R o+rX ./ |
| chgrp -R tomcat conf/ bin/ lib/ | chgrp -R tomcat conf/ bin/ lib/ | ||
| - | chmod g+rwx conf | + | chmod g+rx conf |
| chmod g+r conf/* | chmod g+r conf/* | ||
| chown -R tomcat webapps/ work/ temp/ logs/ | chown -R tomcat webapps/ work/ temp/ logs/ | ||
| + | |||
| + | mkdir / | ||
| + | chown tomcat: | ||
| + | chmod 750 / | ||
| </ | </ | ||
| Line 261: | Line 272: | ||
| [Unit] | [Unit] | ||
| Description=Apache Tomcat Web Application Container | Description=Apache Tomcat Web Application Container | ||
| - | After=syslog.target network.target | + | After=syslog.target network.target |
| [Service] | [Service] | ||
| Line 284: | Line 295: | ||
| WantedBy=multi-user.target | WantedBy=multi-user.target | ||
| </ | </ | ||
| + | < | ||
| + | * Values of '' | ||
| + | * Tomcat will be started under user '' | ||
| + | </ | ||
| - | * Values of Xms a Xmx se are closely dependent on server sizing. If you have enough memory it is strongly advised to use Xmx 6128M or more. | + | * Reload |
| - | + | ||
| - | * Tomcat will be started under user '' | + | |
| - | * After every systemd configuration | + | |
| < | < | ||
| systemctl daemon-reload | systemctl daemon-reload | ||
| </ | </ | ||
| - | | + | |
| + | | ||
| < | < | ||
| systemctl start tomcat | systemctl start tomcat | ||
| + | systemctl enable tomcat | ||
| </ | </ | ||
| + | |||
| * Check that Tomcat runs with desirable parameters: | * Check that Tomcat runs with desirable parameters: | ||
| + | |||
| <code bash> | <code bash> | ||
| - | [root@tomcat1 logs]# ps -u tomcat | + | [root@tomcat1 logs]# ps -ef | grep ^tomcat |
| - | UID PID PPID C STIME TTY TIME CMD | + | tomcat |
| - | tomcat | + | |
| </ | </ | ||
| - | | + | |
| + | | ||
| < | < | ||
| systemctl stop tomcat | systemctl stop tomcat | ||
| - | </ | ||
| - | * Enable tomcat start after OS start: | ||
| - | <code bash> | ||
| - | systemctl enable tomcat | ||
| </ | </ | ||
| Line 323: | Line 337: | ||
| If you want to use them, it is necessary to do following steps. | If you want to use them, it is necessary to do following steps. | ||
| - | First of all, create a database user that you will use for the access to those applications. If you plan to connect to the applications remotely (not only from localhost) you have to also allow communication from your IP. | + | First of all, create a Tomcat' |
| - | Create user like this: | + | * Create |
| + | * Create the a new user in the file ''/ | ||
| + | * The documentation of available roles as well as overall configuration of the application is a part of application installation available at http:// | ||
| - | Create the a new user in the file ''/ | + | The file ''/ |
| - | The documentation of available roles as well as overall configuration of the application is a part of application installation available at http:// | + | |
| - | + | ||
| - | The file ''/ | + | |
| <file xml tomcat-users.xml> | <file xml tomcat-users.xml> | ||
| <?xml version=" | <?xml version=" | ||
| Line 346: | Line 359: | ||
| </ | </ | ||
| - | If you plan to connect to the applications remotely (not only from localhost) you have to also allow communication from your IP. If you see '' | + | * If you plan to connect to the applications remotely (not only from localhost) you have to also allow communication from your IP. |
| + | * If you see '' | ||
| - | Add your IP address into application configuration files. In files ''/ | + | Add your IP address into application configuration files. In files ''/ |
| - | In my case, I want to access | + | For example, if you want to access Tomcat' |
| <file xml context.xml> | <file xml context.xml> | ||
| Line 360: | Line 374: | ||
| </ | </ | ||
| - | Again, restart the tomcat: | + | * Again, restart the tomcat |
| <code bash> | <code bash> | ||
| systemctl restart tomcat | systemctl restart tomcat | ||
| </ | </ | ||
| - | === Apache Tomcat configuration recommended for production | + | === Apache Tomcat configuration recommended for production |
| - | It is advised | + | We advise |
| - | * Remove unnecessary applications that comes with Tomcat: | + | * Remove unnecessary applications that come with Tomcat: |
| <code bash> | <code bash> | ||
| Line 388: | Line 402: | ||
| * In the ''/ | * In the ''/ | ||
| - | * In same file configure | + | * In same file configure |
| < | < | ||
| Line 400: | Line 414: | ||
| * Do not show aplication server version: | * Do not show aplication server version: | ||
| - | * In the file ''/ | + | * In the file ''/ |
| <code xml> | <code xml> | ||
| Line 470: | Line 484: | ||
| HTTPd basic configuration: | HTTPd basic configuration: | ||
| - | Change MPM to worker | + | Change MPM to worker - in the file ''/ |
| <code bash> | <code bash> | ||
| Line 500: | Line 514: | ||
| </ | </ | ||
| - | Virtualhost configuration to forward the communication from port 80 to 443. Add following section and change string 'server' to the real servername in the file ''/ | + | Virtualhost configuration to forward the communication from port 80 to 443. Add following section and change string 'SERVER' to the real servername in the file ''/ |
| <code xml> | <code xml> | ||
| < | < | ||
| Line 534: | Line 548: | ||
| </ | </ | ||
| - | We also have to secure the communication. **Edit** corresponding lines in '' | + | Syntax check before httpd restart |
| - | < | + | |
| - | SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 | + | |
| - | SSLCipherSuite ALL: | + | |
| - | SSLHonorCipherOrder on | + | |
| - | </ | + | |
| - | < | + | |
| - | + | ||
| - | Syntax check before httpd restart: | + | |
| < | < | ||
| httpd -t -D DUMP_VHOST | httpd -t -D DUMP_VHOST | ||
| + | # or apachectl configtest | ||
| </ | </ | ||
| Line 614: | Line 621: | ||
| ==== mod_security configuration - CentOS8 | ==== mod_security configuration - CentOS8 | ||
| - | In the file / | + | Edit the file '' |
| - | * find the rule 900200 and add methods PUT DELETE and PATCH on the line with tx.allowed\_methods. It look like this after change: | + | * find the rule '' |
| < | < | ||
| Line 628: | Line 635: | ||
| </ | </ | ||
| - | * find the rule 900220 and add support for content\_type=application/ | + | * find the rule '' |
| < | < | ||