You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Jaakko Taipale <ja...@dbmanager.fi> on 2009/02/02 10:23:52 UTC
Tomcat configuration with multiple services
Hi,
I have following tomcat server.xml configuration:
<Service name="Public">
<Connector port="80" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
<Engine name="Public" defaultHost="mydomain.com">
<Host name="mydomain.com" appBase="httpapps"
unpackWARs="true" autoDeploy="true"
xmlValidation="false" xmlNamespaceAware="false">
</Host>
<!-- Prevent accessing by IP -->
<Host name="123.123.123.123" appBase="notexist"
xmlValidation="false" xmlNamespaceAware="false">
</Host>
</Engine>
</Service>
<Service name="Secure">
<Connector
port="443" minSpareThreads="5" maxSpareThreads="75"
enableLookups="true" disableUploadTimeout="true"
acceptCount="100" maxThreads="200"
scheme="https" secure="true" SSLEnabled="true"
keystoreFile="/path/somekeystore" keystorePass="*********"
clientAuth="false" sslProtocol="TLS"/>
<Engine name="Secure" defaultHost="mydomain.com">
<Host name="mydomain.com" appBase="httpsapps"
unpackWARs="true" autoDeploy="true"
xmlValidation="false" xmlNamespaceAware="false">
</Host>
<!-- Prevent accessing by IP -->
<Host name="123.123.123.123" appBase="notexist"
xmlValidation="false" xmlNamespaceAware="false">
</Host>
</Engine>
</Service>
There is two services other for http and other for https connections. Is
this right way to do this and does it have some performance issues? Also I
point users accessing by ip to directory that doesn't exist because I want
that robots that are scanning ip addresses doesn't get anything as response,
is there better way to do this (I have tried something with valve but don't
know how to do this with that)?
--
Jaakko
RE: Tomcat configuration with multiple services
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Jaakko Taipale [mailto:jaakko.taipale@dbmanager.fi]
> Subject: VS: Tomcat configuration with multiple services
> The reason why I have two <Host> element is that I have configured my
> applications to different appBase directories as ROOT.
That's a perfectly good reason and an appropriate use for multiple <Host> elements.
> Is there better way?
Not really.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
VS: Tomcat configuration with multiple services
Posted by Jaakko Taipale <ja...@dbmanager.fi>.
Thanks for advices, <transport-guarantee> 'tip' was exactly what I need. I
have now following configuration:
server.xml:
<Service name="Catalina">
<Connector port="80" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="443" />
<Connector
port="443" minSpareThreads="5" maxSpareThreads="75"
enableLookups="true" disableUploadTimeout="true"
acceptCount="100" maxThreads="200"
scheme="https" secure="true" SSLEnabled="true"
keystoreFile="/path/keystore" keystorePass="********"
clientAuth="false" sslProtocol="TLS"/>
<Engine name="Catalina" defaultHost="mydomain.com">
<Host name="mydomain.com" appBase="httpapps"
unpackWARs="true" autoDeploy="true"
xmlValidation="false" xmlNamespaceAware="false" >
</Host>
<Host name="admin.mydomain.com" appBase="adminapps"
unpackWARs="true" autoDeploy="true"
xmlValidation="false" xmlNamespaceAware="false">
</Host>
</Engine>
</Service>
...and I added this in admin application web.xml for ssl forwarding:
<security-constraint>
<web-resource-collection>
<web-resource-name>SLL Forwarding</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
The reason why I have two <Host> element is that I have configured my
applications to different appBase directories as ROOT. That way I got urls:
http://mydomain.com and
https://admin.mydomain.com
don't want to show my appName in url like
http://mydomain.com/myapp and
https://admin.mydomain.com/myadminapp
Is there better way? I know I could use UrlRewriteFilter module but right
now I wouldn't like to add any additional modules to my Tomcat.
--
Jaakko
-----Alkuperäinen viesti-----
Lähettäjä: Caldarale, Charles R [mailto:Chuck.Caldarale@unisys.com]
Lähetetty: 3. helmikuuta 2009 16:44
Vastaanottaja: Tomcat Users List
Aihe: RE: Tomcat configuration with multiple services
> From: Jaakko Taipale [mailto:jaakko.taipale@dbmanager.fi]
> Subject: VS: Tomcat configuration with multiple services
>
> <Connector port="80" protocol="HTTP/1.1"
> connectionTimeout="20000"
> redirectPort="8443" />
> <Connector
> port="443" minSpareThreads="5" maxSpareThreads="75"
> enableLookups="true" disableUploadTimeout="true"
> acceptCount="100" maxThreads="200"
> scheme="https" secure="true" SSLEnabled="true"
> keystoreFile="/path/somekeystore" keystorePass="*********"
> clientAuth="false" sslProtocol="TLS"/>
Your redirectPort should target the configured HTTPS port, not thin air.
> <Engine name="Public" defaultHost="mydomain.com">
> <Host name="mydomain.com" appBase="httpapps"
> unpackWARs="true" autoDeploy="true"
> xmlValidation="false" xmlNamespaceAware="false">
> </Host>
> <Host name="hastobehttps.mydomain.com" appBase="httpsapps"
> unpackWARs="true" autoDeploy="true"
> xmlValidation="false" xmlNamespaceAware="false">
> </Host>
> </Engine>
What are you trying to achieve with the two <Host> elements?
> How can I force that users use https(or prevent http) when they access
> to hastobehttps.mydomain.com?
Read the servlet spec; use a <transport-guarantee> of CONFIDENTIAL for all
your webapps. If you want HTTPS to be used for everything, put the
<security-constraint> element in conf/web.xml so it will be picked up by all
webapps.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
MATERIAL and is thus for use only by the intended recipient. If you received
this in error, please contact the sender and delete the e-mail and its
attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Tomcat configuration with multiple services
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Jaakko Taipale [mailto:jaakko.taipale@dbmanager.fi]
> Subject: VS: Tomcat configuration with multiple services
>
> <Connector port="80" protocol="HTTP/1.1"
> connectionTimeout="20000"
> redirectPort="8443" />
> <Connector
> port="443" minSpareThreads="5" maxSpareThreads="75"
> enableLookups="true" disableUploadTimeout="true"
> acceptCount="100" maxThreads="200"
> scheme="https" secure="true" SSLEnabled="true"
> keystoreFile="/path/somekeystore" keystorePass="*********"
> clientAuth="false" sslProtocol="TLS"/>
Your redirectPort should target the configured HTTPS port, not thin air.
> <Engine name="Public" defaultHost="mydomain.com">
> <Host name="mydomain.com" appBase="httpapps"
> unpackWARs="true" autoDeploy="true"
> xmlValidation="false" xmlNamespaceAware="false">
> </Host>
> <Host name="hastobehttps.mydomain.com" appBase="httpsapps"
> unpackWARs="true" autoDeploy="true"
> xmlValidation="false" xmlNamespaceAware="false">
> </Host>
> </Engine>
What are you trying to achieve with the two <Host> elements?
> How can I force that users use https(or prevent http) when
> they access to hastobehttps.mydomain.com?
Read the servlet spec; use a <transport-guarantee> of CONFIDENTIAL for all your webapps. If you want HTTPS to be used for everything, put the <security-constraint> element in conf/web.xml so it will be picked up by all webapps.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
VS: Tomcat configuration with multiple services
Posted by Jaakko Taipale <ja...@dbmanager.fi>.
If I put two connectors under the same service like this:
<Service name="Public">
<Connector port="80" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
<Connector
port="443" minSpareThreads="5" maxSpareThreads="75"
enableLookups="true" disableUploadTimeout="true"
acceptCount="100" maxThreads="200"
scheme="https" secure="true" SSLEnabled="true"
keystoreFile="/path/somekeystore" keystorePass="*********"
clientAuth="false" sslProtocol="TLS"/>
<Engine name="Public" defaultHost="mydomain.com">
<Host name="mydomain.com" appBase="httpapps"
unpackWARs="true" autoDeploy="true"
xmlValidation="false" xmlNamespaceAware="false">
</Host>
<Host name="hastobehttps.mydomain.com" appBase="httpsapps"
unpackWARs="true" autoDeploy="true"
xmlValidation="false" xmlNamespaceAware="false">
</Host>
</Engine>
</Service>
How can I force that users use https(or prevent http) when they access to
hastobehttps.mydomain.com? I know I can make eg. httpsapps/ROOT/index.html
for redirecting user always to https://hastobehttps.mydomain.com/myapp but
then I have to define "myapp" directory in url and still it is possible to
access my application via http(http://hastobehttps.mydomain.com/myapp).
That's why I have defined two different services. (The previous
configuration is working fine, but sometimes I have to restart tomcat twice
to get it running)
--
Jaakko
-----Alkuperäinen viesti-----
Lähettäjä: Caldarale, Charles R [mailto:Chuck.Caldarale@unisys.com]
Lähetetty: 2. helmikuuta 2009 17:21
Vastaanottaja: Tomcat Users List
Aihe: RE: Tomcat configuration with multiple services
> From: Jaakko Taipale [mailto:jaakko.taipale@dbmanager.fi]
> Subject: Tomcat configuration with multiple services
> There is two services other for http and other for https connections.
> Is this right way to do this
I've never seen anyone try that. Can't imagine what your requirements would
be that result in having multiple <Service> elements in Tomcat. One
normally simply has two <Connector> elements, one for HTTP, one for HTTPS:
http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html
> Also I point users accessing by ip to directory that doesn't exist
> because I want that robots that are scanning ip addresses doesn't get
> anything as response,
Lack of a valid appBase directory will cause a 500 response, not no
response, so that's pretty much a waste of time.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
MATERIAL and is thus for use only by the intended recipient. If you received
this in error, please contact the sender and delete the e-mail and its
attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Tomcat configuration with multiple services
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Jaakko Taipale [mailto:jaakko.taipale@dbmanager.fi]
> Subject: Tomcat configuration with multiple services
> There is two services other for http and other for https
> connections. Is this right way to do this
I've never seen anyone try that. Can't imagine what your requirements would be that result in having multiple <Service> elements in Tomcat. One normally simply has two <Connector> elements, one for HTTP, one for HTTPS:
http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html
> Also I point users accessing by ip to directory that doesn't
> exist because I want that robots that are scanning ip addresses
> doesn't get anything as response,
Lack of a valid appBase directory will cause a 500 response, not no response, so that's pretty much a waste of time.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org