Install Apache 2.2 with OpenSSL and Tomcat connector

Jephe Wu - http://linuxtechres.blogspot.com

Objective: Install Apache, Openssl and Tomcat connector with the latest version to address vulnerabilities
Environment: CentOS 4.4, use chroot configuration (/chroot)


Steps:
1. download the latest softwares from individual websites:
httpd-2.2.15
openssl 1.0.0a
tomcat connector 1.2.30

2. install openssl 1.0.0a
if you have installed previous version of openssl, rename /usr/local/ssl to /usr/local/ssl.version
cd /usr/local; mv ssl ssl.0.9.8d
cd openssl-1.0.0a
./config;make;make test;make install
note: all the files will be written to /usr/local/ssl directory.

3. install httpd 2.2.15
"./configure" \
"--prefix=/usr/local/apache2" \
"--enable-mods-shared=most ssl rewrite deflate headers expires mime-magic unique-id" \
"--with-ssl=/usr/local/ssl" \
"$@"

make;make install

note: Some basic Apache configuration in httpd.conf
LoadModule authz_host_module modules/mod_authz_host.so 

#note: without above, you will get error below when you run 'bin/apachectl configtest' under /usr/local/apache2 directory
#Syntax error on line 167 of /usr/local/apache2/conf/httpd.conf:
#Invalid command 'Order', perhaps misspelled or defined by a module not included in the server configuration

LoadModule deflate_module modules/mod_deflate.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule env_module modules/mod_env.so
LoadModule mime_magic_module modules/mod_mime_magic.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule ssl_module modules/mod_ssl.so
LoadModule cgi_module modules/mod_cgi.so
LoadModule mime_module modules/mod_mime.so
LoadModule alias_module modules/mod_alias.so
LoadModule rewrite_module modules/mod_rewrite.so
Include conf/extra/httpd-default.conf

4.  tomcat connector installation
http://tomcat.apache.org/connectors-doc/

cd /home/jephe/apache2215/tomcat-connectors-1.2.30-src/native
./configure --with-apxs=/usr/local/apache2/bin/apxs
make
cd /home/jephe/apache2215/tomcat-connectors-1.2.30-src/native/apache-2.0
cp mod_jk.so /usr/local/apache2/modules/
add the following line to /usr/local/apache2/conf/httpd.conf LoadModule directive

LoadModule jk_module modules/mod_jk.so

note:
1. you can find the building instruction at http://tomcat.apache.org/connectors-doc/webserver_howto/apache.html

5. Hardening apache
a. change conf/extra/httpd-default.conf
ServerSignature Off
ServerTokens Prod
MaxKeepAliveRequests 10000
TraceEnable off  => disable trace method

b. disable SSL2 and weak ciphers

SSLCipherSuite ALL:!ADH:!EXPORT56:!RC4:+HIGH:+MEDIUM:!LOW:!SSLv2:!EXP:!eNULL

c. put into chroot environment
new method: use apache 2.2. builtin chroot 
Since Apache 2.2.10,  it supports chroot, all you need to do is just put chrootdir /path in the main configuration file httpd.conf. You don't have to create anything under /path

startup Apache with command /usr/local/apache2/bin/apachectl start

Advantage: simplify chroot configuration, Apache 2.2.10 above only, it works with cronolog.
Disadvantage: it doens't work with cognos web gateway, got 'internal server error'. Also, when I tried to use Redirect index.html https://domain/path/to  in Apache virutal host configuration, it doesn't work, I have to change it to RewriteRule ^/$ https://domain/path/to to make this kind of redirection work.

old method: user manual chroot settings
search google.com for 'chroot apache', some page is at
http://www.faqs.org/docs/securing/chap29sec254.html
http://www.linux.com/archive/articles/36331

change /etc/init.d/apache starting script for $HTTPD
to  /usr/sbin/chroot /chroot $HTTPD
note: we use /chroot as chroot directory

[root@web1 conf]# ls /chroot
dev  etc  lib  opt  usr  var

note: according to my test, when you use manual chroot, if you use cronolog , you will hit  the problem, apache cannot find the path of the cronolog, so cannot start up Apache


Advantage: Apache 2.2 doesn't work with this kind of chroot if you are using cronolog, has not tried cognos web gateway, I don't think it works either, because when I was testing cronolog, it cannot find the program path
apache 2.0 is working with both cronolog and cognos web gateway
Disadvantage:  configuration is a bit difficult

6. testing Apache configuration
a.  syntax test
cd /usr/local/apache2
bin/apachectl configtest

b. Qualys SSL server test
https://www.ssllabs.com/ssldb/index.html

7. solution for Apache 2.0, chroot and cognos web gateway, cronolog
Using tranditional chroot, Apache 2.0.63, openssl 0.9.8o version.
If you using openssl 1.0.0.a version, apache 2.0.63 cannot compile successfully.

References:
http://httpd.apache.org/docs/2.2/programs/apxs.html
http://httpd.apache.org/docs/2.2/dso.html

How to setup a tomcat server with JDK and DB2 runtime client

Jephe Wu - http://linuxtechres.blogspot.com


Objective: Preparing a Linux db2 client environment with JDK and Tomcat
Environment: CentOS 5.4, IBM DB2 V8.1 JDK 1.4.2 and Tomcat 4.1


Steps:

1. Preparing JDK environment:
cd /usr/local
./j2sdk-1.4.2xxx.bin
ln -sf j2sdk1.4.2xxx jdk

Put the following to /etc/profile.d/java.sh
export JAVA_HOME=/usr/local/jdk
export PATH=$PATH:$JAVA_HOME/bin
export CLASSPATH=$JAVA_HOME/lib

then run Chmod +x java.sh

2. Preparing Tomcat environment:

# cd /usr/local/
# tar xvpfz /usr/local/src/jakarta-tomcat-4.1.31.tar.gz
# ln –sf  jakarta-tomcat-4.1.31 tomcat

Add tomcat user and group
# groupadd tomcat
# useradd –g tomcat –c “Tomcat User” –d /usr/local/tomcat tomcat
# chown –R tomcat:tomcat Jakarta-tomcat-4.1.31
# chown tomcat:tomcat tomcat


Put the following to /usr/local/tomcat/.bash_profile and give it 755 permission

CATALINA_HOME=/usr/local/tomcat
LD_LIBRARY_PATH=/home/db2inst1/sqllib/lib
LIBPATH=/home/db2inst1/sqlib/lib
DB2INSTANCE=db2inst1
export CATALINA_HOME DB2INSTANCE  LD_LIBRARY_PATH LIBPATH

Modify catalina.sh, to add this:
JAVA_OPTS='-Xmx1024m -XX:+AggressiveHeap' at the top of the file

use cronolog to auto rotate log daily
[jephe@app tomcat]$ grep -A 3 -B 3 cronolog bin/catalina.sh
      -Dcatalina.base="$CATALINA_BASE" \
      -Dcatalina.home="$CATALINA_HOME" \
      -Djava.io.tmpdir="$CATALINA_TMPDIR" \
      org.apache.catalina.startup.Bootstrap "$@" start | /usr/local/sbin/cronolog "$CATALINA_BASE"/logs/%Y-%m-%d.catalina.out \
      >> /dev/null 2>&1 &

      if [ ! -z "$CATALINA_PID" ]; then
          echo $! > $CATALINA_PID
      fi
  fi
note: you  can vi bin/catalina.sh , then search for 'stop' string, before the following line , you can add above cronolog filter
elif [ "$1" = "stop" ] ; then

3. Preparing DB2 Client

download IBM DB2 runtime client from www.ibm.com, login as root to install runtime client software
# cd /root
# tar xvf FP8_M00099.tar
# cd rtcl
#./db2_install (db2setup needs GUI , so use db2_install instead), it will install all  rpms to /opt/IBM/ directory.

create instance (CLI)
# cd /opt/ibm/db2/V8.1/instance
# groupadd  db2grp1
# useradd –c ‘DB2 Instance User’ –g db2grp1 –m db2inst1
# ./db2icrt –s client db2inst1  (important, even installation of rtcl sometimes created /home/db2inst1/sqllibxx for you, rename that, run this command as root)

# su - db2inst1
# db2 catalog tcpip node db1 remote 10.0.3.2 server 50000
note: node name cannot use -, _ is allowed
# db2 catalog database DB1 [ as DB1ALIAS ] at node db1
# db2 list db directory
# db2 list node directory
# db2 connect to DB1ALIAS user jephe using password

# db2 uncatalog node db1
# db2 uncatalog db DB1

 Set environment for db2inst1 user
Append the following into /home/db2inst1/.bash_profile
. /home/db2inst1/sqllib/db2profile

note: testing db2 runtime client first before using tomcat application:

db2 connect to db1 user schemanmame

db2 list tables for all

if you encounter errors like SQL0805N package "NULLID.SQLxxxxxxxxx" was not found. 

try to run 'db2 ? SQL0805N' to follow the suggestion below to bind.

db2 bind @db2ubind.1st blocking all grant public 

4. Setup tomcat again after finishing db2 client setup
Copy connector over
# cd /opt/IBM/db2/V8.1/java
# cp –i  db2java.zip /usr/local/tomcat/common/lib/db2java.jar
note:  you have to copy db2java.zip from db2 runtime client to above tomcat folder which is from tomcat server itself

# chown tomcat:tomcat /usr/local/tomcat/common/lib/db2java.jar


5. Preparing Firewall

Allow port 8080, 8443 and 8009 in /etc/sysconfig/iptables
-A RH-Firewall-1-INPUT –m state –state NEW –m tcp –p tcp –dport 8080 –j ACCEPT
-A RH-Firewall-1-INPUT –m state –state NEW –m tcp –p tcp –dport 8443 –j ACCEPT
-A RH-Firewall-1-INPUT –m state –state NEW –m tcp –p tcp –dport 8009–j ACCEPT

# service iptables restart


6. Make tomcat listening on port 80
This section is referred from http://www.klawitter.de/tomcat80.html (How to run Tomcat on Port 80)

There are a few ways to make tomcat to be listening on port 80, you can run tomcat as root which is not recommended, anther way is to remain tomcat to listen on port 8080, and use iptables to forward port 80 request to tomcat:

steps:

iptables -t nat -A PREROUTING -d your hostname -p tcp --dport 80 -j REDIRECT --to-ports 8080

iptables-save > /etc/sysconfig/iptables
chkconfig iptables on

Under some circumstances, the HttpConenctor class reports the original port back to the client. Further requests will continue with that port (which is not the desired effect and might even be blocked by your firewall).

Besides switching to a more contemporary Connector like CoyoteConenctor (recommended), you can circumvent that problem by adding a proxyPort to the HttpConnector declaration:

<Connector
  className="org.apache.catalina.connector.http.HttpConnector"
  port="8080"
  proxyPort="80"
>

7. FAQ
a. if testing db2 connection got error like 'SQL0805N Package dc2j.NULLID.SQLC2D01.4141414141350 not found.', you can solve it by binding:
login as db2inst1 on db2 client / tomcat server, run:

db2 connect to db1 user db2inst1 (must login as db2inst1, not user)

cd sqllib/bnd
db2 bind   @db2cli.lst 
db2 bind   @db2bind.lst (may not have this filename, then just ignore this line)

tomcat keystore and cacerts

Jephe Wu - http://linuxtechres.blogspot.com

Objective: create SSL certificate for tomcat
Enrironment: Linux server, tomcat, keytool, keystore, cacerts


Concept:
.keystore file which resides /usr/local/tomcat is the default keystore file for tomcat. It's SSL certificate container for server itself, the CA certs file is under /usr/local/jdk/jre/lib/security/.

The self signed SSL certificate generated by keytool or openssl has to be imported to ca certs file in order to avoid SSL warning when the https URL is being accessed from one server to another, without using browser.




Steps:

1. list the existing keys, the default file is .keystore under /usr/local/tomcat folder
# cd /usr/local/tomcat
# keytool -list -v -storepass changeit

2. delete the existing keys( key alias :tomcat)
# cd /usr/local/tomcat
# keytool -delete -alias tomcat -storepass changeit

3. generate self-signed key
# keytool -h for usage
# keytool -genkey -alias tomcat -keysize 1024 -validity 3650 -keypass changeit -storepass changeit
What is your first and last name?
[Unknown]: jephe
What is the name of your organizational unit?
[Unknown]: IS
What is the name of your organization?
[Unknown]: Jephe
What is the name of your City or Locality?
[Unknown]: Singapore
What is the name of your State or Province?
[Unknown]: Singapore
What is the two-letter country code for this unit?
[Unknown]: SG
Is CN=jephe, OU=IS, O=somename, L=Singapore, ST=Singapore, C=SG correct?
[no]: yes


for above self-generated key to work without SSL warning, you need to import to ca certs file

4. list the existing CA certificates from /usr/local/jdk/jre/lib/security/cacerts
# cd /usr/local/jdk/jre/lib/security
# keytool -list -v -keystore cacerts

5. in order to add self-signed key to cacerts, export it first from .keystore file
# keytool -export -alias jephe -keypass changeit -storepass changeit -file /tmp/jephe.der

6. then import to cacerts file under /usr/local/jdk/jre/lib/security/cacerts
# cd /usr/local/jdk/jre/lib/security
# keytool -import -alias jephe -trustcacerts -keystore cacerts -file /tmp/jephe.der -storepass changeit

note: add this key to trusted cacerts and give alias as jephe
you can add one more, but have to give the different alias name


7. you can delete the existing cacert key:
# cd /usr/local/jdk/jre/lib/security
#keytool -delete -keystore cacerts -alias jephe

8. import a openssl generated self signed pem format certificate from openldap server into ca certs file on tomcat server (for ldaps connection from tomcat server to openldap server)

# cd /usr/local/jdk/jre/lib/security
# keytool -import -alias jephe -trustcacerts -keystore cacerts -file /tmp/jephe.pem -storepass changei


References:
1. convert pem to der format

openssl x509 -in cacert.pem -inform PEM -out cacert.der -outform DER