Author: dq

Setting Up the NFS Client


Step One—Download the Required Software

Start off by using apt-get to install the nfs programs. 
apt-get install nfs-common portmap

Step Two—Mount the Directories

Once the programs have been downloaded to the the client server, create the directories that will contain the NFS shared files 
mkdir -p /mnt/nfs/fs-01.sda1


mkdir -p /mnt/nfs/fs-01.sdb1

prevent accedent writes:

sudo chmod 000 /mnt/nfs/fs-01.sda1

sudo chmod 000 /mnt/nfs/fs-01.sdb1 

sudo mount fileshare-01:/mnt/local/sda1/ /mnt/nfs/fs-01.sda1/




You can use the df -h command to check that the directories have been mounted. You will see them last on the list.



df -h



Filesystem             Size  Used Avail Use% Mounted on/dev/sda                20G  948M   19G   5% /udev                   119M  4.0K  119M   1% /devtmpfs                   49M  208K   49M   1% /runnone                   5.0M     0  5.0M   0% /run/locknone                   122M     0  122M   0% /run/shmfileshare-01:/home      20G  948M   19G   5% /mnt/nfs/homefileshare-01:/var/nfs   20G  948M   19G   5% /mnt/nfs/var/nfs




Additionally, use the mount command to see the entire list of mounted file systems.

mount




Your list should look something like this:

/dev/sda on / type ext4 (rw,errors=remount-ro,barrier=0) [DOROOT]proc on /proc type proc (rw,noexec,nosuid,nodev)sysfs on /sys type sysfs (rw,noexec,nosuid,nodev)none on /sys/fs/fuse/connections type fusectl (rw)none on /sys/kernel/debug type debugfs (rw)none on /sys/kernel/security type securityfs (rw)udev on /dev type devtmpfs (rw,mode=0755)devpts on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=0620)tmpfs on /run type tmpfs (rw,noexec,nosuid,size=10%,mode=0755)none on /run/lock type tmpfs (rw,noexec,nosuid,nodev,size=5242880)none on /run/shm type tmpfs (rw,nosuid,nodev)rpc_pipefs on /run/rpc_pipefs type rpc_pipefs (rw)fileshare-01:/home on /mnt/nfs/home type nfs (rw,vers=4,addr= fileshare-01,clientaddr=192.168.1.xxx)fileshare-01:/var/nfs on /mnt/nfs/var/nfs type nfs (rw,vers=4,addr=12.34.56.78,clientaddr=192.168.1.xxx)








  Testing the NFS Mount
Once you have successfully mounted your NFS
directories, you can test that they work by creating files on the Client
and checking their availability on the Server.



Create a file in each directory to try it out:

touch /mnt/nfs/fs-01.sda1/test.txt



touch /mnt/nfs/fs-01.sdb1/test.txt






You should then be able to find the files on the Server in the /home and /var/nfs directories.



ls /home






ls /mnt/nfs/






You can ensure that the mount is always active by adding the directories
to the fstab file on the client. This will ensure that the mounts start
up after the server reboots.

vi /etc/fstab





fileshare-999:/mnt/local/sdx1/test/ /mnt/nfs/fs-99.sdx1.test/ nfs4 _netdev,auto,hard,intr,retry=1,nolock,bg 0 0




fileshare-01:/mnt/local/sda1/ /mnt/nfs/fs-01.sda1/ nfs4 _netdev,auto,retry=1,nolock,bg,intr 0 0







You can learn more about the fstab options by typing in:



man nfs




Any subsequent restarts will include the NFS mount—although the mount
may take a minute to load after the reboot You can check the mounted
directories with the two earlier commands:

df -h






mount






 Removing the NFS Mount
Should you decide to remove a directory, you can unmount it using the umount command:



sudo umount /directory name





You can see that the mounts were removed by then looking at the filesystem again.

df -h





You should find your selected mounted directory gone.
	


	
	






	
	

		
Setting Up the NFS Server
	


	

		


About NFS (Network File System) Mounts



NFS mounts work to share a directory between several virtual servers.
This has the advantage of saving disk space, as the home directory is
only kept on one virtual private server, and others can connect to it
over the network. When setting up mounts, NFS is most effective for
permanent fixtures that should always be accessible.

Setup



An NFS mount is set up between at least two virtual servers. The machine
hosting the shared network is called the server, while the ones that
connect to it are called ‘clients’.



This tutorial requires 2 servers: one acting as the server and one as
the client. We will set up the server machine first, followed by the
client. The following IP addresses will refer to each one:



Master: fileshare-01

Client: database-01


There are 3 ways to do this.




OPTION 1 (Public share, everything is owned by 

OPTION 2 (User share, user has access to only there data)



OPTION 3 ()



The system should be set up as root. You can access the root user by typing



sudo su








  Setting Up the NFS Server





 Step One—Download the Required Software
Start off by using apt-get to install the nfs programs.

apt-get install nfs-kernel-server portmap






Step Two—Export the Shared Directory
The next step is to decide
which directory we want to share with the client server. The chosen
directory should then be added to the /etc/exports file, which specifies
both the directory to be shared and the details of how it is shared. 



Suppose we wanted to share two directories: /home and /var/nfs.



Because the /mnt/local/ does not exist, we need to do two things before we can export it. 



First, we need to create the directory itself:

mkdir /mnt/local/




We will have 2 physical disks loaded at this location /sda1 and /sdb1



sudo chmod 755 sda1 sdb1


Second, we should change the ownership of the directory to the user,
nobody and the group, no group. These represent the default user through
which clients can access a directory shared through NFS. 



Go ahead and chown the directory:

chown root:root /mnt/local




Option 1:




chown nobody:nogroup /mnt/local/sda1




chown nobody:nogroup /mnt/local/sdb1



Option 2:




chown uid:gui /mnt/local/sda1




chown uid:gui /mnt/local/sdb1





After completing those steps, it’s time to export the directories to the other VPS.



vi /etc/exports




Add the following lines to the bottom of the file, sharing both directories with the client:



Share with clients on subnet:  ->  192.168.1.0/24   (This is the one we will use) 



Share with specific server:      -> database-01 	







Option 1:




/mnt/local/sda1         192.168.1.0/24(rw,nohide,no_subtree_check,async,all_squash)

/mnt/local/sdb1         192.168.1.0/24(rw,nohide,no_subtree_check,async,all_squash)





Option 2:  Below is what QBW has




/mnt/local/sda1         192.168.1.0/24(rw,sync,no_root_squash,nohide,no_subtree_check)

/mnt/local/sdb1         192.168.1.0/24(rw,sync,no_root_squash,nohide,no_subtree_check)




/mnt/local/sdb1/test    192.168.1.0/24(rw,sync,root_squash,nohide,no_subtree_check)












These settings accomplish several tasks:



    
	
  • rw: This option allows the client server to both read and write within the shared directory

    • 
	
  • sync: Sync confirms requests to the shared directory only once the changes have been committed. 

    • 
	
  • no_subtree_check: This option prevents the subtree checking.
	When a shared directory is the subdirectory of a larger filesystem, nfs
	performs scans of every directory above it, in order to verify its
	permissions and details. Disabling the subtree check may increase the
	reliability of NFS, but reduce security.

    • 
	
  • no_root_squash: This phrase allows root to connect to the designated directory
    • 




Once you have entered in the settings for each directory, run the following command to export them:

 /etc/init.d/nfs-kernel-server restart






to see your exports



exportfs -v



Now for the CLIENT.


	


	
	






	
	

		
Setting Up the NFS Client
	


	

		





Step One—Download the Required Software
Start off by using apt-get to install the nfs programs.

apt-get install nfs-common portmap








 Step Two—Mount the Directories
Once the programs have been downloaded to the the client server, create the directories that will contain the NFS shared files

mkdir -p /mnt/nfs/fs-01.sda1






mkdir -p /mnt/nfs/fs-01.sdb1








prevent accedent writes:




sudo chmod 000 /mnt/nfs/fs-01.sda1








sudo chmod 000 /mnt/nfs/fs-01.sdb1






sudo mount fileshare-01:/mnt/local/sda1/ /mnt/nfs/fs-01.sda1/






You can use the df -h command to check that the directories have been mounted. You will see them last on the list.



df -h



Filesystem             Size  Used Avail Use% Mounted on/dev/sda                20G  948M   19G   5% /udev                   119M  4.0K  119M   1% /devtmpfs                   49M  208K   49M   1% /runnone                   5.0M     0  5.0M   0% /run/locknone                   122M     0  122M   0% /run/shmfileshare-01:/home      20G  948M   19G   5% /mnt/nfs/homefileshare-01:/var/nfs   20G  948M   19G   5% /mnt/nfs/var/nfs




Additionally, use the mount command to see the entire list of mounted file systems.

mount




Your list should look something like this:

/dev/sda on / type ext4 (rw,errors=remount-ro,barrier=0) [DOROOT]proc on /proc type proc (rw,noexec,nosuid,nodev)sysfs on /sys type sysfs (rw,noexec,nosuid,nodev)none on /sys/fs/fuse/connections type fusectl (rw)none on /sys/kernel/debug type debugfs (rw)none on /sys/kernel/security type securityfs (rw)udev on /dev type devtmpfs (rw,mode=0755)devpts on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=0620)tmpfs on /run type tmpfs (rw,noexec,nosuid,size=10%,mode=0755)none on /run/lock type tmpfs (rw,noexec,nosuid,nodev,size=5242880)none on /run/shm type tmpfs (rw,nosuid,nodev)rpc_pipefs on /run/rpc_pipefs type rpc_pipefs (rw)fileshare-01:/home on /mnt/nfs/home type nfs (rw,vers=4,addr= fileshare-01,clientaddr=192.168.1.xxx)fileshare-01:/var/nfs on /mnt/nfs/var/nfs type nfs (rw,vers=4,addr=12.34.56.78,clientaddr=192.168.1.xxx)








  Testing the NFS Mount
Once you have successfully mounted your NFS
directories, you can test that they work by creating files on the Client
and checking their availability on the Server.



Create a file in each directory to try it out:

touch /mnt/nfs/fs-01.sda1/test.txt



touch /mnt/nfs/fs-01.sdb1/test.txt






You should then be able to find the files on the Server in the /home and /var/nfs directories.



ls /home






ls /mnt/nfs/






You can ensure that the mount is always active by adding the directories
to the fstab file on the client. This will ensure that the mounts start
up after the server reboots.

vi /etc/fstab



fileshare-01:/mnt/local/sda1/ /mnt/nfs/fs-01.sda1/ nfs4 _netdev,auto,retry=1,nolock,bg,intr 0 0

fileshare-01:/mnt/local/sdb1/ /mnt/nfs/fs-01.sdb1/ nfs4 _netdev,auto,retry=1,nolock,bg,intr 0 0



You can learn more about the fstab options by typing in:



man nfs




Any subsequent restarts will include the NFS mount—although the mount
may take a minute to load after the reboot You can check the mounted
directories with the two earlier commands:

df -h






mount






 Removing the NFS Mount
Should you decide to remove a directory, you can unmount it using the umount command:



sudo umount /directory name





You can see that the mounts were removed by then looking at the filesystem again.

df -h





You should find your selected mounted directory gone.
	


	
	






	
	

		
Log user activity
	


	

		

  • ~/.bash_history will show the commands that was used by a user.
    • 

    
Install acct : sudo apt-get install acct in addition to login/logout. It provides  logs of every single command run by every single user. Below mentioned commands are the features of acct

    

      
	
    • ac      print statistics about connect time
      • 
	
    • accton      turns accounting on or off
      • 
	
    • last        list last logins of users and terms
      • 
	
    • lastcomm        list last commands executed
      • 
	
    • sa      print accounting statistics
      • 
	
    • dump-acct      print accounting file in human-readable form
      • 

    

    
 ==========================================

    

    
https://launchpad.net/ubuntu/precise/+source/activity-log-manager/0.9.4-0ubuntu3.2

    

    
 ==========================================

    

    
==========================================

    
	
    

	
	


    


    
	
	
    
		
    Linux RunAs uid/gid
    	
    

	
    
		

    
http://blog.teksol.info/pages/daemontools/tutorial

    

    
http://thedjbway.b0llix.net/daemontools/uidgid.html

    

    
http://manpages.ubuntu.com/manpages/precise/man8/setuidgid.8.html

    

    
Your environment variables will contain passwords, and you don’t want those files to be world-readable. Set your environment’s directory permissions to 0700, and the individual files to 0600. Then, ensure you always setuidgid last in your run scripts.


    



    



    

    
sudo apt-get install daemontools

    

    
###  vi touch1.sh ============================

    

    
#!/bin/sh
    
exec 2>&1

    

    
exec setuidgid www-data touch /mnt/nfs/fs-01.sdb1/www.data1.log

    

    
###  vi touch2.sh   ============================

    

    
#!/bin/sh
    
exec 2>&1

    

    
exec setuidgid www-data sh -c 'echo "hello world" > /mnt/nfs/fs-01.sdb1/www.data2.log'

    

    
###  vi touch3.sh   ============================

    

    
#!/bin/sh
    
exec 2>&1

    

    
sh ./touch1.sh
    
sh ./touch2.sh

    

    
How-to-run-a-Java-Application-from-Bash-Script

    
	
    

	
	


    


    
	
	
    
		
    Rename Ubuntu Server
    	
    

	
    
		

    
So, you just screwed up the name of your Ubuntu server?

    

    
Well that can be changed in no time and with no downtime

    

    
Just follow the below steps;

    

      
	
    • Set a new hostname
      • 

    

    
	
    
	sudo hostname new.host.name
	
    

    

      
	
    • Edit the /etc/hosts file
      • 

    

    
	
    
	sudo vi /etc/hosts
	
    

    

      
	
    • Edit the /etc/hostname file
      • 

    

    
	
    
	sudo vi /etc/hostname
	
    

    

    
In some circumstances you may also have to change the /etc/resolv.conf file.

    

      
	
    • prove that it works
      • 

    

    
	
    
	sudo reboot
	
    

    

    
Simple, yes! But worth 90 seconds to write out ;P

    
	
    

	
	


    




    
	
	
    
		
    Tomcat CatchAll (Hosts)
    	
    

	
    
		

    
Re: Several hosts within one tomcat / catch-all problem 2010-11-21 20:08
    

    
Hi Konstantin,
    
>BTW, you can put those names in an external file and use it in the
    
>server.xml as an XML entity. Like the example in
    
>http://wiki.apache.org/tomcat/FAQ/Password
    
Inspired by this thread and having a similar issue in maintaining virtual host aliases I edited my server.xml as follows:
    
I added this before the <Server>.
    
<!DOCTYPE aliases-xml [
    
<!ENTITY aliases SYSTEM "/path/to/network/storage/aliases.txt">
    
]>
    
    I moved my <Alias> tags to /path/to/network/storage/aliases.txt, substituting &aliases;
    
This works very well. Thanks!
    
>and use JMX or call mapper.addHostAlias(..) directly to add aliases
    
>programmatically at runtime.  (though there is no guarantee that the
    
>Mapper API does not change between Tomcat minor releases).
    
I investigated what an implementation of this might look like at a higher level. In looking through the Tomcat interfaces it looks like this is similar to the notion of automatically creating Context for users with a UserConfig listener.
    
It would be an AliasConfig class extending HostConfig.
    
<Listener className="my.web.server.listener.package.AliasConfig" aliases="/path/to/alias/file"/>
    
Then in the start event function it is as simple as "host.addAlias(subDomainName);" for each alias found in the aliases file.
    
Does this make sense?
    
Regards,
    
Dave
    

    

    
	
    

	
	


    


    
	
	
    
		
    Tomcat and Apache Setup – With LB
    	
    

	
    
		

    
Tomcat and Apache Setup

    

    
My example at bottom…

    

    
Most Tomcat configurations are a Apache/Tomcat setup, Apache serving up the static content and then passing any JSP to Tomcat to process. Tomcat can be integrated with Apache by using the JK Connector. The JK Connector uses the Apache JSserv Protocol (AJP) for communications between Tomcat and Apache.

    

    
The AJP Connector

    

    
The AJP protocol is used for communication between Tomcat and Apache, the software modules used on Apache are mod_jk or mod_proxy. Both are native code extension modules written in C/C++, on the Tomcat side the software module is the AJP Connector written in Java.

    

    
The below diagram shows how the native code Apache module (mod_jk or mod_proxy) works with Tomcat. Apache will receive the incoming JSP or servlet request and using the Apache module will pass this request via the AJP protocol to Tomcat, the response will also be sent back to the Apache server via the AJP protocol.

    

    


    

    
The Apache JServ Protocol (AJP) uses a binary format for transmitting data between the Web server and Tomcat, a network socket is used for all communication. The AJP packet consist of a packet header and a payload, below is the structure of the packet

    

    


    

    
As you can see, the binary packet starts with the sequence 0X1234, this is followed by the packet size (2 bytes) and then the actual payload. On the return path the packets are prefixed by AB (the ASCII codes for A and B), the size of the packet and then the payload.

    

    
The major feature of this protocol are

    

      
	
    • Good performance on fast networks
      • 
	
    • Support for SSL, encryption and client certificate
      • 
	
    • Support of clustering by forwarding requests to multiple Tomcat 6 servers
      • 

    

    
One of the ways the AJP protocol reduces latency is by making the Web server reuse already open TCP-level connections with Tomcat. This saves the overhead of opening a new socket connections for each request, its a bit like a connection pool.

    

    
The configuration of a AJP Connector is below

    

    
	
		
    
			AJP Connector example 
			<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" /> 
		
    
	    

    

    
Tomcat Workers

    

    
A worker represents a running instance of Tomcat, a worker serves the requests for all dynamic web components. However you can run multiple instances of Tomcat in a cluster to implement load balancing or site partitioning. Each worker is identified by a unique hostname or a unique IP address and port number. You may what to implement multiple workers for the following reasons

    

      
	
    • When you want different Web application contexts to be served by different Tomcat workers
      • 
	
    • When you want different virtual hosts to be served by different Tomcat workers
      • 
	
    • When you want to service more requests than the capacity of a single physical server
      • 

    

    
To let Apache know where the Tomcat servers are a file called workers.properties is created detailing this information. I describe this file next

    

    
	
		
    
			
			
    
			Worker List 
			
    
			    		
		
    
		
    
			Attribute
			Description
		
    
		
    
			work.list
			
			
    
			Describe the workers that are available to Apache via a list
			
    
			    		
		
    
		
    
			
			
    
			Worker Types 
			
    
			    		
		
    
		
    
			Attribute
			Description
		
    
		
    
			ajp13
			
			
    
			This type of worker represents a running Tomcat instance
			
    
			    		
		
    
		
    
			lb
			
			
    
			used for load balancing
			
    
			    		
		
    
		
    
			status
			
			
    
			display useful information about how the load among the various Tomcat workers is distributed
			
    
			    		
		
    
		
    
			jni
			
			
    
			Used in process, this worker handles the forwarding of requests to in-process Tomcat workers using JNDI
			
    
			    		
		
    
		
    
			ajp12
			
			
    
			worker that support the AJP 1.2 protocol
			
    
			    		
		
    
		
    
			
			
    
			Other Worker Properties 
			
    
			    		
		
    
		
    
			Attribute
			Description
		
    
		
    
			worker.test1.type
			Describes the type of worker (see above for types) 
		
    
		
    
			worker.test1.host
			
			
    
			The host where the worker Tomcat instance resides
			
    
			    		
		
    
		
    
			worker.test1.port
			
			
    
			The port the AJP 1.3 Connector Tomcat instance is listening on (default 8009)
			
    
			    		
		
    
		
    
			worker.test1.connection_pool_size
			
			
    
			The number of connections used for this worker to be kept in a connection pool
			
    
			    		
		
    
		
    
			worker.test1.connection_pool_minsize
			
			
    
			The minimum number of connections kept in a connection pool
			
    
			    		
		
    
		
    
			worker.test1.connection_pool_timeout
			
			
    
			
    
			The number of seconds that connections to this worker should be left in the connection before expiry
			
    
			
    
			    		
		
    
		
    
			worker.test1.mount
			The contexts paths that are serviced by the worker, you can also use the JkMount directive in the http.conf file 
		
    
		
    
			worker.test1.retries
			
			
    
			Controls the number of times mod_jk will retry when a worker returns a error
			
    
			    		
		
    
		
    
			worker.test1.socket_timeout
			
			
    
			controls how long a worker will wait for a response on a socket before indicating an error
			
    
			    		
		
    
		
    
			worker.test1.socket_keepalive
			indicates if the connection to the worker should be subject to keep alive 
		
    
		
    
			worker.test1.lbfactor
			
			
    
			An integer indicating the local-balance factor used by the load balancer to distribute work between multiple instances of Tomcat.
			
    
			    		
		
    
		
    
			
			
    
			Worker Loading Balancing Properties 
			
    
			    		
		
    
		
    
			Attribute
			Description
		
    
		
    
			worker.bal1.balance_workers
			A list of workers to load balance between 
		
    
		
    
			worker.bal1.lock
			The type of locking used O (Optimistic) or P (Pessimistic) 
		
    
		
    
			worker.bal1.method
			
			
    
			can be set to R (Requests), T (Traffic), B (Busy-ness)
			
    
			
    
			R = The worker to use is based on the number of requests forwarded
    
			T = The worker to use is based on the traffic that had been sent to the workers
    
			B = The worker to use is based on the load dividing the number of concurrent requests by the load factor
			
    
			    		
		
    
		
    
			worker.bal1.secret
			Sets a default secret password for all workers 
		
    
		
    
			worker.bal1.sticky_session
			
			
    
			Tells the mod_jk to respect the sessionID in the request and ensures that the same session is always serviced by the same worker instance.
			
    
			    		
		
    
		
    
			worker.bal1.sticky_session_force
			This is used for failover 
		
    
		
    
			
			
    
			Example
			
    
			    		
		
    
		
    
			Simple example
			worker.list = worker1
    
			worker.worker1.type = ajp13 
    
			worker.worker1.host = 192.168.0.1
    
			worker.worker1.port = 9009
    
			worker.worker1.connection_pool_size = 5
    
			worker.worker1.connection_pool_timeout = 300     		
		
    
		
    
			Load Balancing example 
			
			
    
			worker.list = loadbal1,stat1
    
			
    
			worker.tomcatA.type = ajp13
    
			worker.tomcatA.host =192.168.0.1
    
			worker.tomcatA.port = 8009
    
			worker.tomcatA.lbfactor = 10
    
			
    
			worker.tomcatB.type = ajp13
    
			worker.tomcatB.host =192.168.0.2
    
			worker.tomcatB.port = 8009
    
			worker.tomcatB.lbfactor = 10
    
			
    
			worker.tomcatC.type = ajp13
    
			worker.tomcatC.host =192.168.0.3
    
			worker.tomcatC.port = 8009
    
			worker.tomcatC.lbfactor = 10
    
			
    
			worker.loadbal1.type = lb
    
			worker.loadbal1.sticky_seesion = 1
    
			worker.loadbal1.balance_workers = tomcatA, tomcatB, tomcatC
    
			
    
			worker.stat1.type= status
			
    
			
    
			Note: if one of your servers is a slow server then lower the lbfactor of that server
			
    
			    		
		
    
	    

    

    
There are a number of Apache directives that you can configure in the httpd.conf file

    

    
	
		
    
			
			
    
			Apache mod_jk Directives 
			
    
			    		
		
    
		
    
			Directive
			Description
		
    
		
    
			JkWorkerFile
			tells mod_jk where to find the workers property file 
		
    
		
    
			JkLogFile
			tells mod_jk where to write its logs 
		
    
		
    
			JkLogLevel
			sets the level of logging (info, error or debug) 
		
    
		
    
			JkRequestLogFormat
			specifies the log format, below are the options that you can use 
    
			
    
			
    
				
					
    
						%b or %B
						bytes transmitted (not counting HTTP headers)
					
    
					
    
						%H 
						request protocol
					
    
					
    
						%m
						request method
					
    
					
    
						%p 
						port of the server for the request
					
    
					
    
						%r 
						first line of the request
					
    
					
    
						%T 
						request duration
					
    
					
    
						%U 
						URL of the request with query string removed
					
    
					
    
						%v or %V
						server name
					
    
					
    
						%w
						name of the tomcat worker
					
    
					
    
						%R 
						the route name of the session 
					
    
				    
			
    
			
    
			    		
		
    
		
    
			JkMount
			control the URL matching and forwarding to the Tomcat workers 
		
    
		
    
			
			
    
			Example
			
    
			    		
		
    
		
    
			JkWorkerFile
			JkWorkerFile conf/worker.properties 
		
    
		
    
			JkLogFile
			JkLogFile /var/logs/httpd/mod_jk.log
		
    
		
    
			JkLogLevel
			JkLogLevel debug
		
    
		
    
			JkRequestLogFormat
			JkRequestLogFormat "%w %U %T"
		
    
		
    
			JkMount
			JkMount /examples/jsp/* worker1 
		
    
	    

    

    
Configuring SSL for Apache

    

    
SSL provides a secure connection between Tomcat and Apache, the steps involved in getting this working are

    

      
	
    • Install OpenSSL on your server
      • 
	
    • Check that Apache has mod_ssl support
      • 
	
    • Get or generate a SSL certificate and install it into Apache
      • 
	
    • Test the SSL-enabled Apache-Tomcat setup
      • 

    

    
To make sure that you have openssl installed and the mod_ssl modules installed in Apache run the following

    

    
	
		
    
			Check foe OpenSSL 
			# openssl version 
		
    
		
    
			Check for Apache module mod_ssl
			# <apache path>/httpd -D DUMP_MODULES 
		
    
	    

    

    
If any of these are not installed then I recommend you download the latest version and install as per the Installation guides.

    

    
There are a number of steps to generate a test certificate using OpenSSL

    

      
	
    • Create the configuration file for generating the certificate
      • 
	
    • Create a certificate signing request, this is what you send to the CA if you are buying a certificate
      • 
	
    • Remove the passphrase from the private key
      • 
	
    • Purchase a certificate from a CA or create a self-signed certificate
      • 
	
    • Install the key and certificate to the Apache server
      • 

    

    
Below are the steps to creating your own cert

    

    
	
		
    
			step 1 
			
			
    
			Create a working directory called certs
    
			# mkdir certs
    
			# cd certs
    
			
    
			Create a configuration file (myconfig.file) as below
			
    
			
    
			RANDFILE = ./random.txt
    
			[req]
    
			default_bits = 1024
    
			default_keyfile = keyfile.pem
    
			attributes = req_attributes
    
			distinguished_name = Datadisk
    
			prompt = no
    
			output_password = secret
    
			[Datadisk]
    
			C = UK
    
			ST = Bucks
    
			L = Milton Keynes
    
			O = Datadisk
    
			OU = IT Consultant
    
			CN = 192.168.0.1
    
			emailAddress = paul.valle@datadisk.co.uk
    
			[req_attributes]
    
			challengePassword = secret
			
    
			
    
			Create a random file called random.txt put a large number in it
			
    
			    		
		
    
		
    
			step 2 
			
			
    
			Now create the certificate
    
			
    
			# openssl req -new -out server.csr -config myconfig.file
			
    
			
    
			Two files should have been created server.csr and keyfile.pem
			
    
			    		
		
    
		
    
			step 3 
			Now remove the passphrase from the private key
    
			
    
			# openssl rsa -in keyfile.pem -out server.key     		
		
    
		
    
			step 4 
			
			
    
			Now create a self-signed certificate
			
    
			
    
			# openssl X509 -in server.csr -out server.crt -req -signkey server.key -days 365
			
    
			
    
			Note: in a production environment the certificate signing request file generated (server.csr) is sent to a Certificate Authority and a certificated purchased
			
    
			    		
		
    
		
    
			step 5 
			Last but not least copy the server.key and server.crt in to the Apache conf directory 
		
    
	    

    

    
To setup the mod_ssl in Apache you need to perform the following in Apache httpd.conf file

    

    
	
		
    
			include the httpd-ssl.conf
			include conf/extra/httpd-ssl.conf 
		
    
		
    
			Load the SSL modules 
			LoadModule ssl_module modules/mod_ssl.so 
		
    
		
    
			SSLCertificateKeyFile
			set this attribute to the path to the server.key file 
		
    
		
    
			SSLCertificateFile
			set this attribute to the path to the server.crt file 
		
    
	    

    

    
Once all the above is completed you can now point your browser to the Apache server, hopefully the browser will pop up with a security alert (because of the self-signed certificate).

    

    
The only change to make the Apache-Tomcat setup is to change the <VirtualHost> attribute

    

    
	
		
    
			<VirtualHost>
			<virtualHost _default_:443>
    
			….
    
			JkWorkersFile ……
    
			JkMount …….. 
    
			</VirtualHost>     		
		
    
	    

    

    
Load Balancing

    

    
I will be discussing Tomcat clustering in a later topic will describes a more detailed viewing of load balancing and persistent sessions with-in-memory session replication but for this section I will discuss a basic load balancing solution.

    

    
The mod_proxy module can also be used for load balancing but will not be discussed here, the mod_jk module sup[ports load balancing with seamless sessions, it uses a simple round-robin algorithm. Each Tomcat worker is weighted in the worker.properties file which specifies how the request load is distributed between workers.

    

    
A seamless session is also known as session affinity or a sticky session. When a request is made any of the Tomcat instances is used, but any subsequent request will be routed to the same Tomcat instance. to keep the same user session.

    

    
The following steps are required to set up load balancing in Tomcat

    

      
	
    • Change the CATALINA_HOME in the Tomcat startup files to point to different locations for each of the Tomcat instances
      • 
	
    • Set different AJP Connector ports for the instances
      • 
	
    • Disable the Coyote HTTP/1.1 Connector
      • 
	
    • set the jvmroute in the Standalone Engine
      • 
	
    • Configure the Tomcat worker in the workers.properties file.
      • 

    

    
One assumption I will be making here is that all the Tomcat instances will be running on the same server

    

    
The first step is to change the CATALINA_HOME variable in each of the startup.bat (Windows) or startup.sh (Unix) instances

    

    
	
		
    
			CATALINA_HOME
			
			
    
			set CATALINA_HOME=c:\apps\tomcatA
			
    
			
    
			Note: the other Tomcat instances would be tomcatB and tomcatC
			
    
			    		
		
    
	    

    

    
Now in each Tomcat instance we must set a different AJP Connector port number (server.xml)

    

    
	
		
    
			AJP Connector port 
			
			
    
			<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
			
    
			
    
			Note: on the other Tomcat instances use ports 8010 and 8011
			
    
			    		
		
    
	    

    

    
To avoid startup/shutdown port conflicts we must change each Tomcats worker server port (server.xml)

    

    
	
		
    
			server port 
			
			
    
			<Server port="8005" shutdown="SHUTDOWN" debug="0">
			
    
			
    
			Note: on the other Tomcat instances use ports 8006 and 8007
			
    
			    		
		
    
	    

    

    
Because all the Tomcat instances will be running in conjunction with the load-balancer worker, it's possible that someone could directly access any of the available workers vioa the default HTTP Connector, by passing the load-balancer path. To avoid this comment out the HTTP Connector configuration of all the Tomcat instances (server.xml)

    

    
	
		
    
			disable HTTP Connector 
			
			
    
			<!– Define 
    
			<Connector port="8080"
    
			protocol="HTTP/1.1"
    
			maxThreads="150"
    
			connectionTimeout="20000"
    
			redirectPort="8443"
    
			/>
    
			–> 
			
    
			    		
		
    
	    

    

    
An important step for load balancing is specifying the jvmRoute. The jvmRoute is an attribute of Engine directive that acts as an identifier for that particular Tomcat worker. The attribute must be unique across all Tomcat instances, this unique ID is used in the workers.properties file for identifying each Tomcat worker (server.xml).

    

    
	
		
    
			jvmRoute
			
			
    
			<Engine name="Standalone" defaultHost="localhost" jvmRoute="tomcatA" >
			
    
			
    
			Note: the other Tomcat instances would be tomcatB and tomcatC
			
    
			    		
		
    
	    

    

    
You will also need to comment out the Catalina Engine directive (server.xml)

    

    
	
		
    
			Catalina Engine disable 
			
			
    
			<!– Define 
    
			<Engine name="Catalina" defaultHost="localhost" > 
    
			–> 
			
    
			
    
			Note: the other Tomcat instances would be tomcatB and tomcatC
			
    
			    		
		
    
	    

    

    
In Apache's httpd.,conf file you need to add some load balancing directives, also make sure you have the module mod_jk loaded

    

    
	
		
    
			httpd.conf directives 
			
			
    
			JkWorkersFile conf/worker.properties
    
			JkMount /examples/jsp/* bal1
    
			JkMount /jkstatus/ stat1
			
    
			    		
		
    
	    

    

    
The last thing is to create the workers property file, i have already discuss this file above.

    

    
	
		
    
			worker.properties file 
			
			
    
			worker.list = loadbal1,stat1
    
			
    
			worker.tomcatA.type = ajp13
    
			worker.tomcatA.host =192.168.0.1
    
			worker.tomcatA.port = 8009
    
			worker.tomcatA.lbfactor = 10
    
			
    
			worker.tomcatB.type = ajp13
    
			worker.tomcatB.host =192.168.0.1
    
			worker.tomcatB.port = 8010
    
			worker.tomcatB.lbfactor = 10
    
			
    
			worker.tomcatC.type = ajp13
    
			worker.tomcatC.host =192.168.0.1
    
			worker.tomcatC.port = 8011
    
			worker.tomcatC.lbfactor = 10
    
			
    
			worker.loadbal1.type = lb
    
			worker.loadbal1.sticky_seesion = 1
    
			worker.loadbal1.balance_workers = tomcatA, tomcatB, tomcatC
    
			
    
			worker.stat1.type= status
			
    
			    		
		
    
	    

    

    
To test the load balancer and sticky sessions use the below JSP page (one for each instance), just place it in the webapps/examples/jsp directory.

    

    
	
		
    
			jsp test page 
			
			
    
			<%@ page language="java" %>
    
			<html>
    
			<body>
    
			<h1><font color="red">Index Page by tomcatA</font></h1>
    
			<table> align="centre" border="1">
    
			<tr>
    
			<td>Session ID</td>
    
			<td><%= session.getId() %></td>
    
			</tr>
    
			<tr>
    
			<td>Created on </td>
    
			<td><%= session.getCreationTime() %></td>
    
			</tr>
    
			</table>
    
			</body>
    
			< /html>
			
    
			    		
		
    
	    

    

    
Use the below URL's for testing, etc. Don't forget to play around with the lbfactor on each Tomcat instance to see what affect it has.

    

    
	
		
    
			URL's
			
			
    
			http://local/examples/jsp/index.jsp
    
			http://localhost/jkstatus
			
    
			    		
		
    
	    

    

    

    

    
==============================================

    
Be sure to update sample.com with new loadbalancer modJK

    

    

    

    

    
Don't forget to set your jvmRoute on each instance of TomCat within the server.xml

    

    
    <Engine name="Catalina" defaultHost="localhost">–>
    
    <Engine name="Catalina" defaultHost="localhost" jvmRoute="tc8xx">
    

    

    
==============================================

    

    
My Example located: vi /etc/libapache2-mod-jk/workers.properties

    

    
==============================================

    
#
    

    
# The workers that your plugins should create and work with
    
#
    
#worker.list=loadbalancer,status
    
#worker.list=loadbal1,stat1
    
worker.list=lb_tc8xx,lb_tc81x,stat1

    

    
#
    
#—— ajp13_worker WORKER DEFINITION ——————————
    
#———————————————————————
    
#

    

    
#
    
# Defining a worker named ajp13_worker and of type ajp13
    
# Note that the name and the type do not have to match.
    
#
    
worker.tc811.host=192.168.1.81
    
worker.tc811.port=8113
    
worker.tc811.type=ajp13

    

    
worker.tc812.host=192.168.1.81
    
worker.tc812.port=8123
    
worker.tc812.type=ajp13

    

    
worker.tc821.host=192.168.1.82
    
worker.tc821.port=8213
    
worker.tc821.type=ajp13

    

    
worker.tc822.host=192.168.1.82
    
worker.tc822.port=8223
    
worker.tc822.type=ajp13

    

    
#
    
# Specifies the load balance factor when used with
    
# a load balancing worker.
    
# Note:
    
#  —-> lbfactor must be > 0
    
#  —-> Low lbfactor means less work done by the worker.
    
worker.tc811.lbfactor=1
    
worker.tc812.lbfactor=1
    
worker.tc821.lbfactor=1
    
worker.tc822.lbfactor=1
    
#
    
# Specify the size of the open connection cache.
    
#worker.ajp13_worker.cachesize

    

    
#
    
#—— DEFAULT LOAD BALANCER WORKER DEFINITION ———————-
    
#———————————————————————
    
#

    

    
#
    
# The loadbalancer (type lb) workers perform wighted round-robin
    
# load balancing with sticky sessions.
    
# Note:
    
#  —-> If a worker dies, the load balancer will check its state
    
#        once in a while. Until then all work is redirected to peer
    
#        workers.
    
#        workers.

    

    

    
#Method — can be set to R (Requests), T (Traffic), B (Busy-ness)
    
# R = The worker to use is based on the number of requests forwarded
    
# T = The worker to use is based on the traffic that had been sent to the workers
    
# B = The worker to use is based on the load dividing the number of concurrent requests by the load factor

    

    
#setup the load-balancer
    
worker.lb_tc8xx.type=lb
    
worker.lb_tc8xx.method=R
    
worker.lb_tc8xx.balance_workers=tc811,tc812,tc821,tc822
    
worker.lb_tc8xx.sticky_session=True
    
###(This will generate a 500 instead of rerouting to a new server)
    
#worker.loadbalancer.sticky_session_force=True

    

    
worker.lb_tc81x.type=lb
    
worker.lb_tc81x.method=R
    
worker.lb_tc81x.balance_workers=tc811,tc812
    
worker.lb_tc81x.sticky_session=True
    
###(This will generate a 500 instead of rerouting to a new server)
    
#worker.loadbalancer.sticky_session_force=True

    

    

    
# Status worker for managing load balancer
    
worker.stat1.type=status

    

    

    
	
    

	
	


    


    
	
	
    
		
    Tomcat with Apache2 VirtualHost AJP (mod_jk)
    	
    

	
    
		

    Tomcat changes: 
    

    
You should be able to visit http://yourip:8080/manager/html and the below:

    


    
Deploy your tomcat application sample.war (433.79 kb) using the manager.

    

    
Note down the deployed application name (sample).

    

    
Edit /etc/tomcat7inst/8xx/conf/server.xml with following lines AFTER the ending </Host> tag, and BEFORE the ending </Engine> tag, insert the following:

    

    
<!– sample.com (here the appname is derived from the deploy above)–>
    
 <Host name="    www.sample.com" appBase="webapps" unpackWARs="true" autoDeploy="true">
    
          <Alias>sample.com</Alias>
    
          <Context path="" docBase="sample" debug="0" reloadable="true"/>
    
 </Host>
    

    

    
Find the following in the same file (server.xml) and uncomment by removing <!– and –>
    
< !–
    
<Connector port=”8009″ protocol=”AJP/1.3″ redirectPort=”8443″ />
    
–>

    

    
 <Connector port="8xx8" protocol="AJP/1.3" redirectPort="8443" />

    

    
Edit /etc/tomcat7inst/880/bin/startup.sh

    

    
export JAVA_OPTS="
    
-Dcom.qbw.instance=880
    
-Xms1g -Xmx1g -XX:MaxPermSize=128m
    
-Djava.rmi.server.hostname=192.168.1.186
    
"

    

    

    
Issue following the following command to activate the tomcat virtual host settings:

    

    
/etc/init.d/tomcat8xx stop 

    

    
/etc/init.d/tomcat8xx start 

    

    

    

    Apache2 changes with load balancer:
    

    
Install the modjk module using following commad:

    

    
apt-get install libapache2-mod-jk

    

    
Files created:

    

      
	
    • /etc/libapache2-mod-jk/workers.properties
      • 
	
    • /var/log/apache2/mod_jk.log
      • 
	
    • /var/log/apache2/jk-runtime-status
      • 

    

    
Edit /etc/libapache2-mod-jk/workers.properties

    

    
#workers.tomcat_home=/usr/share/tomcat6
    

    
#workers.java_home=/usr/lib/jvm/default-java
    

    
# Change to your port
    

    
worker.ajp13_worker.port=8108                    
    

    
#Change to your Tomcat IP
    
worker.ajp13_worker.host=192.168.1.126
    
worker.ajp13_worker.type=ajp13
    
 
    

    
Create a apache2 virtualhost for eg. sample.com.conf with following contents on it.

    

    
<VirtualHost *:80>
    
    ServerName     www.sample.com
    
    ServerAlias sample.com
    

    
    ServerAdmin webmaster@sample.com
    

    
    JkMount /* ajp13_worker
    

    
    CustomLog /srv/www-logs/sample.com.access.log combined
    
    ErrorLog  /srv/www-logs/sample.com.error.log
    
</VirtualHost>
    

    
 
    

    
<VirtualHost sample.com:80>
    
ServerName sample.com
    
ServerAlias sample.com     

    

    
DocumentRoot /var/lib/tomcat6/webapps/appname/
    
<Directory /var/lib/tomcat6/webapps/appname/>
    
Options FollowSymLinks Indexes
    
AllowOverride None
    
</Directory>
    
JkMount /* ajp13_worker
    
</VirtualHost>    

    

    
Save conf file

    

    
Enable site:

    

    
     cd /etc/apache2/sites-available

    

    
     a2ensite sample.com.conf

    

    
Restart apache2 with following command /etc/init.d/apache2 restart 

    

    
Update your hosts file to point sample.com to ip 192.168.1.186  (apache server ip)

    

    
Figures crossed. If every is followed as specified, the tomcat webapp deployed as appname shall be visible in your browser as simple apache2 page such as http://abc.com as opposed to http://abc.com:8080

    

    
Benefit: From now on, we just need to deploy the tomcat application and finally apache2 virtualhost creation followed by a restart to activate the new settings.

    

    

    
	
    

	
	


    

    Tag Cloud