You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@geronimo.apache.org by Hernan Cunico <hc...@gmail.com> on 2006/02/20 17:15:30 UTC
How to configure a remote HTTPd
Hi All,
I just updated the documentation. The following article covers how to configure the Apache HTTPd to
forward client requests to Geronimo in two different ways, either as a reverse proxy or using the
Jakarta Tomcat Connector.
http://opensource2.atlassian.com/confluence/oss/display/GERONIMO/Remote+HTTPd+Server
Cheers!
Hernan
Re: How to configure a remote HTTPd
Posted by Hernan Cunico <hc...@gmail.com>.
Hi Jeff,
I normally use the console as the sample application because it is the easiest application to test
and everybody knows where it is. I personally do not believe that anybody will be interested in
having the console exposed :) but for the "just in case", I added a couple of *WARNINGS* in red to
catch the readers attention there ;) ..btw, thanks for the feedback..
I am planning to add an article to discuss different topologies for implementing Geronimo, discuss
the pros and cons of each topology (security, performance, high availability, etc). I think it would
be good to have a few different topologies described (solution oriented) where you could see the
different nodes (remote http, app server, db, ldap, etc.), likelyhood of firewalls and the
connectivity requirements between the nodes.
It would be great to have a few extra hands for working on this topic, volunteers welcome :)
Cheers!
Hernan
Jeff Genender wrote:
> Hernan,
>
> Great article. One thing you may wish to add is discussion of the
> security consequences of exposing /console. This will usually be a URL
> that is not exposed to the public via a front ended httpd setup...as it
> would be considered a security risk. Typically, a front ended web
> server will be used for production, so this may be a good tip to add.
> Perhaps in your examples you could expose one of the example
> applications, or show how to expose the whole server, but offer an
> example of where you can deny access to the console for security
> purposes. Its just a small hint for security conscious folks.
>
> Jeff
>
> Hernan Cunico wrote:
>
>>Hi All,
>>I just updated the documentation. The following article covers how to
>>configure the Apache HTTPd to forward client requests to Geronimo in two
>>different ways, either as a reverse proxy or using the Jakarta Tomcat
>>Connector.
>>
>>http://opensource2.atlassian.com/confluence/oss/display/GERONIMO/Remote+HTTPd+Server
>>
>>
>>Cheers!
>>Hernan
>
>
Re: How to configure a remote HTTPd
Posted by Jeff Genender <jg...@apache.org>.
Hernan,
Great article. One thing you may wish to add is discussion of the
security consequences of exposing /console. This will usually be a URL
that is not exposed to the public via a front ended httpd setup...as it
would be considered a security risk. Typically, a front ended web
server will be used for production, so this may be a good tip to add.
Perhaps in your examples you could expose one of the example
applications, or show how to expose the whole server, but offer an
example of where you can deny access to the console for security
purposes. Its just a small hint for security conscious folks.
Jeff
Hernan Cunico wrote:
> Hi All,
> I just updated the documentation. The following article covers how to
> configure the Apache HTTPd to forward client requests to Geronimo in two
> different ways, either as a reverse proxy or using the Jakarta Tomcat
> Connector.
>
> http://opensource2.atlassian.com/confluence/oss/display/GERONIMO/Remote+HTTPd+Server
>
>
> Cheers!
> Hernan
Re: How to configure a remote HTTPd
Posted by Paul Watkins <pw...@pabloa.pswdic.com>.
Joacim,
How about the following which is in my conf.d directory under Fedora Linux
for httpd (/etc/httpd/conf.d/proxy_ajp.conf
==========================
LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
#
# When loaded, the mod_proxy_ajp module adds support for
# proxying to an AJP/1.3 backend server (such as Tomcat).
# To proxy to an AJP backend, use the "ajp://" URI scheme;
# Tomcat is configured to listen on port 8009 for AJP requests
# by default.
#
#
# Uncomment the following lines to serve the ROOT webapp
# under the /tomcat/ location, and the jsp-examples webapp
# under the /examples/ location.
#
#ProxyPass /tomcat/ ajp://localhost:8009/
#ProxyPass /examples/ ajp://localhost:8009/jsp-examples/
===================================================================
Of course the ProxyPass statements would be modified as you have them for
Geronimo but the single module: mod_proxy_ajp.so seems to replace the two
modules you show in your write-up. If this is the case, you may want to
note this in your excellent write-up.
Thanks,
Paul
> Hi Joacim,
> can you send me the section where you are loading modules in the
> httpd.conf
> not too sure whether it is complaining about the directive or the file, at
> this point it could even
> be access rights.
>
> Not that is going to fix the error but why are you using 1.2.14 instead of
> 1.2.6?
>
> Cheers!
> Hernan
>
> Joacim J wrote:
>> Hernan,
>>
>> Good writing but I can't get it working.
>> I have Geronimo 1.0 with Tomcat.
>> I'm using mod_jk and when starting apache I get:
>>
>> [root@bridget modules]# /sbin/service httpd restart
>> Stopping httpd: [ OK ]
>> Starting httpd: Syntax error on line 1087 of /etc/httpd/conf/httpd.conf:
>> Cannot load /etc/httpd/modules/mod_jk.so into server:
>> /etc/httpd/modules/mod_jk.so: cannot open shared object file: No such
>> file or directory
>> [FAILED]
>> I have downloaded
>> http://ftp.solace.mh.se/pub/mirrors/www.apache.org/tomcat/tomcat-connectors/jk/binaries/linux/jk-1.2.14/jakarta-tomcat-connectors-jk-1.2.14-linux-sles9-x86_64-worker.so
>> for my Fedora Core 4 and renamed it to mod_jk.so and placed it here:
>>
>> [root@bridget modules]# ls -al /etc/httpd/modules/mod_jk.so
>> -rwxr-xr-x 1 root root 558327 Jul 29 2005 /etc/httpd/modules/mod_jk.so
>> [root@bridget modules]#
>>
>> It's driving me nuts...can you give me some tip?
>>
>> BR
>> Joacim
>>
>> On 2/20/06, Hernan Cunico <hc...@gmail.com> wrote:
>>
>>>Hi All,
>>>I just updated the documentation. The following article covers how to
>>> configure the Apache HTTPd to
>>>forward client requests to Geronimo in two different ways, either as a
>>> reverse proxy or using the
>>>Jakarta Tomcat Connector.
>>>
>>>http://opensource2.atlassian.com/confluence/oss/display/GERONIMO/Remote+HTTPd+Server
>>>
>>>Cheers!
>>>Hernan
>>>
>>
>>
>>
>> --
>> Regards
>> Joacim
>>
>
Re: How to configure a remote HTTPd
Posted by Hernan Cunico <hc...@gmail.com>.
Joacim J wrote:
> In fact, I tried 1.2.6 it seems to work just fine. I used 1.2.14 since
> it is a later version (or?)
I thought 1.2.6 was the latest stable version (it was, now it is 1.2.15 which I'm testing now :) )
>
> Right now I have this on a global level, right after the LoadModules section:
Yes, it should work if you add it at the very end of the httpd.conf. I assume, since you are in
Linux, you load the module as .so (.dll is just for windows) and this is directly from the article.
> --------------------------
> LoadModule jk_module modules/mod_jk.dll
> # Loads the Jakarta Tomcat Connector module
>
> JkWorkersFile <httpd_home>\conf\workers.properties
> # Tells the module the location of the workers.properties file
>
> JkLogFile <httpd_home>\logs\mod_jk.log
> # Specifies the location for this module's specific log file
>
> JkLogLevel info
> # Sets the module's log level to info
>
> JkLogStampFormat "[%a %b %d %H:%M:%S %Y] "
> # Sets the module's log time stamp format
>
> JkAutoAlias <httpd_home>\config-store
> # Automatically Alias webapp context directories into the Apache document space.
> --------------------------
>
> and
> JkMount /console/* ajp13
> in a virtual host.
>
> I have another question (a bit OT). I have this virtual host:
>
> <VirtualHost *:80>
> DocumentRoot /srv/www/virtual/admin.mydomain.com
> ServerName admin.mydomain.com
> ServerAlias *.admin.mydomain.com
> <Directory "/srv/www/virtual/admin.mydomain.com">
> AuthType Basic
> AuthName "Admin @ mydomain.com"
> AuthUserFile /srv/www/virtual/.htpasswd_admin
> Require valid-user
> </Directory>
> JkMount /console/* ajp13
> </VirtualHost>
>
> If I go to the page http://admin.mydomain.com I get the password
> dialog but not if going to http://admin.mydomain.com/console/
> I have tried to add the JkMount inside the <Directory> but it's not
> allowed there. Any idea to have the complete http://admin.mydomain.com
> secured by basic authentication?
AFAIK, when Apache HTTPd see a request matching the JkMount it will forward that request to the
destination server defined in the workers.properties . I don't think HTTPd should take care of
securing an external resource. I will investigate more this module implementation and a workaround
configuration.
Cheers!
Hernan
>
> Best Regard
> Joacim J
>
>
> On 2/21/06, Hernan Cunico <hc...@gmail.com> wrote:
>
>>Hi Joacim,
>>can you send me the section where you are loading modules in the httpd.conf
>>not too sure whether it is complaining about the directive or the file, at this point it could even
>>be access rights.
>>
>>Not that is going to fix the error but why are you using 1.2.14 instead of 1.2.6?
>>
>>Cheers!
>>Hernan
>>
>>Joacim J wrote:
>>
>>>Hernan,
>>>
>>>Good writing but I can't get it working.
>>>I have Geronimo 1.0 with Tomcat.
>>>I'm using mod_jk and when starting apache I get:
>>>
>>>[root@bridget modules]# /sbin/service httpd restart
>>>Stopping httpd: [ OK ]
>>>Starting httpd: Syntax error on line 1087 of /etc/httpd/conf/httpd.conf:
>>>Cannot load /etc/httpd/modules/mod_jk.so into server:
>>>/etc/httpd/modules/mod_jk.so: cannot open shared object file: No such
>>>file or directory
>>> [FAILED]
>>>I have downloaded
>>>http://ftp.solace.mh.se/pub/mirrors/www.apache.org/tomcat/tomcat-connectors/jk/binaries/linux/jk-1.2.14/jakarta-tomcat-connectors-jk-1.2.14-linux-sles9-x86_64-worker.so
>>>for my Fedora Core 4 and renamed it to mod_jk.so and placed it here:
>>>
>>>[root@bridget modules]# ls -al /etc/httpd/modules/mod_jk.so
>>>-rwxr-xr-x 1 root root 558327 Jul 29 2005 /etc/httpd/modules/mod_jk.so
>>>[root@bridget modules]#
>>>
>>>It's driving me nuts...can you give me some tip?
>>>
>>>BR
>>>Joacim
>>>
>>>On 2/20/06, Hernan Cunico <hc...@gmail.com> wrote:
>>>
>>>
>>>>Hi All,
>>>>I just updated the documentation. The following article covers how to configure the Apache HTTPd to
>>>>forward client requests to Geronimo in two different ways, either as a reverse proxy or using the
>>>>Jakarta Tomcat Connector.
>>>>
>>>>http://opensource2.atlassian.com/confluence/oss/display/GERONIMO/Remote+HTTPd+Server
>>>>
>>>>Cheers!
>>>>Hernan
>>>>
>>>
>>>
>>>
>>>--
>>>Regards
>>>Joacim
>>>
>>
>
>
> --
> Regards
> Joacim
>
Re: How to configure a remote HTTPd
Posted by Joacim J <jo...@gmail.com>.
In fact, I tried 1.2.6 it seems to work just fine. I used 1.2.14 since
it is a later version (or?)
Right now I have this on a global level, right after the LoadModules section:
--------------------------
LoadModule jk_module modules/mod_jk.dll
# Loads the Jakarta Tomcat Connector module
JkWorkersFile <httpd_home>\conf\workers.properties
# Tells the module the location of the workers.properties file
JkLogFile <httpd_home>\logs\mod_jk.log
# Specifies the location for this module's specific log file
JkLogLevel info
# Sets the module's log level to info
JkLogStampFormat "[%a %b %d %H:%M:%S %Y] "
# Sets the module's log time stamp format
JkAutoAlias <httpd_home>\config-store
# Automatically Alias webapp context directories into the Apache document space.
--------------------------
and
JkMount /console/* ajp13
in a virtual host.
I have another question (a bit OT). I have this virtual host:
<VirtualHost *:80>
DocumentRoot /srv/www/virtual/admin.mydomain.com
ServerName admin.mydomain.com
ServerAlias *.admin.mydomain.com
<Directory "/srv/www/virtual/admin.mydomain.com">
AuthType Basic
AuthName "Admin @ mydomain.com"
AuthUserFile /srv/www/virtual/.htpasswd_admin
Require valid-user
</Directory>
JkMount /console/* ajp13
</VirtualHost>
If I go to the page http://admin.mydomain.com I get the password
dialog but not if going to http://admin.mydomain.com/console/
I have tried to add the JkMount inside the <Directory> but it's not
allowed there. Any idea to have the complete http://admin.mydomain.com
secured by basic authentication?
Best Regard
Joacim J
On 2/21/06, Hernan Cunico <hc...@gmail.com> wrote:
> Hi Joacim,
> can you send me the section where you are loading modules in the httpd.conf
> not too sure whether it is complaining about the directive or the file, at this point it could even
> be access rights.
>
> Not that is going to fix the error but why are you using 1.2.14 instead of 1.2.6?
>
> Cheers!
> Hernan
>
> Joacim J wrote:
> > Hernan,
> >
> > Good writing but I can't get it working.
> > I have Geronimo 1.0 with Tomcat.
> > I'm using mod_jk and when starting apache I get:
> >
> > [root@bridget modules]# /sbin/service httpd restart
> > Stopping httpd: [ OK ]
> > Starting httpd: Syntax error on line 1087 of /etc/httpd/conf/httpd.conf:
> > Cannot load /etc/httpd/modules/mod_jk.so into server:
> > /etc/httpd/modules/mod_jk.so: cannot open shared object file: No such
> > file or directory
> > [FAILED]
> > I have downloaded
> > http://ftp.solace.mh.se/pub/mirrors/www.apache.org/tomcat/tomcat-connectors/jk/binaries/linux/jk-1.2.14/jakarta-tomcat-connectors-jk-1.2.14-linux-sles9-x86_64-worker.so
> > for my Fedora Core 4 and renamed it to mod_jk.so and placed it here:
> >
> > [root@bridget modules]# ls -al /etc/httpd/modules/mod_jk.so
> > -rwxr-xr-x 1 root root 558327 Jul 29 2005 /etc/httpd/modules/mod_jk.so
> > [root@bridget modules]#
> >
> > It's driving me nuts...can you give me some tip?
> >
> > BR
> > Joacim
> >
> > On 2/20/06, Hernan Cunico <hc...@gmail.com> wrote:
> >
> >>Hi All,
> >>I just updated the documentation. The following article covers how to configure the Apache HTTPd to
> >>forward client requests to Geronimo in two different ways, either as a reverse proxy or using the
> >>Jakarta Tomcat Connector.
> >>
> >>http://opensource2.atlassian.com/confluence/oss/display/GERONIMO/Remote+HTTPd+Server
> >>
> >>Cheers!
> >>Hernan
> >>
> >
> >
> >
> > --
> > Regards
> > Joacim
> >
>
--
Regards
Joacim
Re: How to configure a remote HTTPd
Posted by Hernan Cunico <hc...@gmail.com>.
Hi Joacim,
can you send me the section where you are loading modules in the httpd.conf
not too sure whether it is complaining about the directive or the file, at this point it could even
be access rights.
Not that is going to fix the error but why are you using 1.2.14 instead of 1.2.6?
Cheers!
Hernan
Joacim J wrote:
> Hernan,
>
> Good writing but I can't get it working.
> I have Geronimo 1.0 with Tomcat.
> I'm using mod_jk and when starting apache I get:
>
> [root@bridget modules]# /sbin/service httpd restart
> Stopping httpd: [ OK ]
> Starting httpd: Syntax error on line 1087 of /etc/httpd/conf/httpd.conf:
> Cannot load /etc/httpd/modules/mod_jk.so into server:
> /etc/httpd/modules/mod_jk.so: cannot open shared object file: No such
> file or directory
> [FAILED]
> I have downloaded
> http://ftp.solace.mh.se/pub/mirrors/www.apache.org/tomcat/tomcat-connectors/jk/binaries/linux/jk-1.2.14/jakarta-tomcat-connectors-jk-1.2.14-linux-sles9-x86_64-worker.so
> for my Fedora Core 4 and renamed it to mod_jk.so and placed it here:
>
> [root@bridget modules]# ls -al /etc/httpd/modules/mod_jk.so
> -rwxr-xr-x 1 root root 558327 Jul 29 2005 /etc/httpd/modules/mod_jk.so
> [root@bridget modules]#
>
> It's driving me nuts...can you give me some tip?
>
> BR
> Joacim
>
> On 2/20/06, Hernan Cunico <hc...@gmail.com> wrote:
>
>>Hi All,
>>I just updated the documentation. The following article covers how to configure the Apache HTTPd to
>>forward client requests to Geronimo in two different ways, either as a reverse proxy or using the
>>Jakarta Tomcat Connector.
>>
>>http://opensource2.atlassian.com/confluence/oss/display/GERONIMO/Remote+HTTPd+Server
>>
>>Cheers!
>>Hernan
>>
>
>
>
> --
> Regards
> Joacim
>
Re: How to configure a remote HTTPd
Posted by Joacim J <jo...@gmail.com>.
Hernan,
Good writing but I can't get it working.
I have Geronimo 1.0 with Tomcat.
I'm using mod_jk and when starting apache I get:
[root@bridget modules]# /sbin/service httpd restart
Stopping httpd: [ OK ]
Starting httpd: Syntax error on line 1087 of /etc/httpd/conf/httpd.conf:
Cannot load /etc/httpd/modules/mod_jk.so into server:
/etc/httpd/modules/mod_jk.so: cannot open shared object file: No such
file or directory
[FAILED]
I have downloaded
http://ftp.solace.mh.se/pub/mirrors/www.apache.org/tomcat/tomcat-connectors/jk/binaries/linux/jk-1.2.14/jakarta-tomcat-connectors-jk-1.2.14-linux-sles9-x86_64-worker.so
for my Fedora Core 4 and renamed it to mod_jk.so and placed it here:
[root@bridget modules]# ls -al /etc/httpd/modules/mod_jk.so
-rwxr-xr-x 1 root root 558327 Jul 29 2005 /etc/httpd/modules/mod_jk.so
[root@bridget modules]#
It's driving me nuts...can you give me some tip?
BR
Joacim
On 2/20/06, Hernan Cunico <hc...@gmail.com> wrote:
> Hi All,
> I just updated the documentation. The following article covers how to configure the Apache HTTPd to
> forward client requests to Geronimo in two different ways, either as a reverse proxy or using the
> Jakarta Tomcat Connector.
>
> http://opensource2.atlassian.com/confluence/oss/display/GERONIMO/Remote+HTTPd+Server
>
> Cheers!
> Hernan
>
--
Regards
Joacim