Installation Guide

Before installing JBoss Web Server, you must first install a supported Java Development Kit (JDK).

For a list of supported JDKs for Red Hat JBoss Web Server 5.0, see: JBoss Web Server 5 Supported Configurations.

The installation of the OpenJDK or the IBM JDK are presented here. To install the Oracle JDK, follow the instructions provided by Oracle at: http://www.oracle.com/technetwork/java/javase/downloads/index.html.

Installing a JDK using the YUM package manager

Installing a JDK from a compressed archive (such as .zip or .tar)

If the JDK was downloaded from the vendor’s website (Oracle, IBM or OpenJDK), use the installation instructions provided by the vendor and set the JAVA_HOME environment variable.

If the JDK has was installed from a compressed archive, set the JAVA_HOME environment variable for Tomcat before running JBoss Web Server.

In the bin directory of Tomcat (JWS_HOME/tomcat/bin), create a file named setenv.sh, and insert the JAVA_HOME path definition.

For example:

$ cat JWS_HOME/tomcat/bin/setenv.sh

export JAVA_HOME=/usr/lib/jvm/jre-1.8.0-openjdk.x86_64

Before installing JBoss Web Server on Red Hat Enterprise Linux, ensure the following prerequisites are met.

To install JBoss Web Server, download and extract the installation ZIP files.

The directory created by extracting the ZIP archives is the top-level directory for JBoss Web Server. This is referred to as JWS_HOME.

There is three supported methods for running and managing Red Hat JBoss Web Server on Red Hat Enterprise Linux:

The recommended method for managing the JBoss Web Server is using a system daemon.

# cd JWS_HOME/tomcat
# sh .postinstall.sysv

# cd JWS_HOME/tomcat
# sh .postinstall.systemd

$ sh JWS_HOME/tomcat/bin/startup.sh

$ sh JWS_HOME/tomcat/bin/shutdown.sh

Before downloading and installing the RPM packages, you must register your system with Red Hat Subscription Management and subscribe to the respective Content Delivery Network (CDN) repositories.

For information on registering Red Hat Enterprise Linux, see Configuring the Subscription Service for Red Hat Enterprise Linux 6 or The Subscription Manager for Red Hat Enterprise Linux 7.

Use the following commands to enable the JBoss Web Server services to start at boot.

The following table contains information about the SELinux policies provided in the jws5-tomcat-selinux packages.

For more information about using SELinux and other Red Hat Enterprise Linux security information, see the Red Hat Enterprise Linux Security Guide.

SELinux policies for JBoss Web Server are provided by the jws5-tomcat-selinux package. These packages are available in the JWS channel.

To enable SELinux policies for JBoss Web Server 5.0, install the jws5-tomcat-selinux package.

In this release, SELinux policies are provided in the ZIP packages. The SELinux security model is enforced by the kernel and ensures applications have limited access to resources such as file system locations and ports. This helps ensure that the errant processes (either compromised or poorly configured) are restricted and in some cases prevented from running.

The .postinstall.selinux file is included in the tomcat folder of jws-application-server-5.0.0-<platform>-<architecture>.zip. If required, you can run the .postinstall.selinux script.

To install the SELinux policies using ZIP:

Using the JBoss Web Server with SysV provides start, stop and status check functions for the tomcat service. This procedure shows how to add JBoss Web Server 5.0 to SysV.

Prerequisites

Procedure

Results

The JBoss Web Server 5.0 instance of tomcat should now be present in SysV. For example:

$ service jws5-tomcat status

jws5-tomcat is stopped

Next Steps

For information on the basic commands for controlling JBoss Web Server 5.0 using SysV, see: Section 4.4.2, “Managing the JBoss Web Server using SysV”.

Additional Resources

For information on using SysV, see: Red Hat Enterprise Linux 6 Deployment Guide: Running Services

SysV commands can only be issued by the root user.

For information on using SysV, see: Red Hat Enterprise Linux 6 Deployment Guide: Running Services

Using the JBoss Web Server with Service Management Facility (SMF) provides start, stop and status check functions for the tomcat service. This procedure shows how to add JBoss Web Server 5.0 to the SMF.

Prerequisites

Procedure

Results

The JBoss Web Server 5.0 instance of tomcat should now be present in the SMF. For example:

# svcs -l jws5-tomcat

fmri         svc:/jws5-tomcat:default
enabled      true
state        online
next_state   none
state_time   July 25, 2018 01:59:29 AM AEST
logfile      /var/svc/log/jws5-tomcat:default.log
restarter    svc:/system/svc/restarter:default
manifest     /lib/svc/manifest/site/jws5-tomcat.xml
dependency   require_all/none svc:/milestone/multi-user (online)

Next Steps

For information on the basic commands for controlling JBoss Web Server 5.0 using the SMF, see: Section 4.4.4, “Managing the JBoss Web Server using the Service Management Facility (SMF)”.

Additional Resources

The Service Management Facility (SMF) is the default system daemon for Oracle Solaris 10 or higher.

SMF commands can only be issued by the root user.

Additional Resources

To start JBoss Web Server: as the root user, run the following command:

# sh JWS_HOME/tomcat/bin/daemon.sh start

To stop JBoss Web Server: as the root user, run the following command:

# sh JWS_HOME/tomcat/bin/daemon.sh stop

org.apache.tomcat.util.digester.PROPERTY_SOURCE=org.apache.tomcat.vault.util.PropertySourceVault

To use a password vault, you must first create a Java keystore. You can do this using the keytool -genseckey command. For example:

$ keytool -genseckey -keystore JWS_HOME/tomcat/vault.keystore -alias my_vault  -storetype jceks -keyalg AES -keysize 128 -storepass <vault_password> -keypass <vault_password> -validity 730

For an explanation of the parameters, use the keytool -genseckey -help command.

The vault.properties file for the tomcat-vault can be stored outside of JWS_HOME/tomcat/conf/ in a CATALINA_BASE/conf/ directory (if set).

To set the CATALINA_BASE directory, follow the instructions in the section 'Advanced Configuration - Multiple Tomcat Instances' in the Running The Apache Tomcat 9.0 Servlet/JSP Container document found on the Apache Tomcat Website.

For more information on setting CATALINA_BASE, see:

The vault must be initialized before it can be used to store sensitive strings. This is done using the JWS_HOME/tomcat/bin/tomcat-vault.sh vault script. For Microsoft Windows, the script is tomcat-vault.bat.

The script can be run interactively or non-interactively. Below is an example of an interactive execution of the script to initialize a password vault, with the values shown below using the example keystore from the previous step.

# JWS_HOME/tomcat/bin/tomcat-vault.sh

WARNING JBOSS_HOME may be pointing to a different installation - unpredictable results may occur.

=========================================================================

  JBoss Vault

  JBOSS_HOME: JWS_HOME/tomcat

  JAVA: java

=========================================================================

**********************************
****  JBoss Vault  ***************
**********************************
Please enter a Digit::
0: Start Interactive Session
1: Remove Interactive Session
2: Exit

0

Starting an interactive session
Enter directory to store encrypted files: JWS_HOME/tomcat/
Enter Keystore URL: JWS_HOME/tomcat/vault.keystore
Enter Keystore password: <vault_password>
Enter Keystore password again: <vault_password>
Values match
Enter 8 character salt: 1234abcd
Enter iteration count as a number (Eg: 44): 120
Enter Keystore Alias: my_vault
Initializing Vault
Jun 16, 2018 10:24:27 AM org.apache.tomcat.vault.security.vault.PicketBoxSecurityVault init
INFO: PBOX000361: Default Security Vault Implementation Initialized and Ready
Vault Configuration in tomcat properties file:
********************************************
...
KEYSTORE_URL=JWS_HOME/tomcat/vault.keystore
KEYSTORE_PASSWORD=MASK-3CuP21KMHn7G6iH/A3YpM/
KEYSTORE_ALIAS=my_vault
SALT=1234abcd
ITERATION_COUNT=120
ENC_FILE_DIR=JWS_HOME/tomcat/
...
********************************************
Vault is initialized and ready for use
Handshake with Vault complete
Please enter a Digit::
0: Store a secured attribute
1: Check whether a secured attribute exists
2: Exit

2

KEYSTORE_URL=JWS_HOME/tomcat/vault.keystore
KEYSTORE_PASSWORD=MASK-3CuP21KMHn7G6iH/A3YpM/
KEYSTORE_ALIAS=my_vault
SALT=1234abcd
ITERATION_COUNT=120
ENC_FILE_DIR=JWS_HOME/tomcat/

$ JWS_HOME/tomcat/bin/tomcat-vault.sh \
 --keystore JWS_HOME/tomcat/vault.keystore \
 --keystore-password <vault_password> \
 --alias my_vault \
 --enc-dir JWS_HOME/tomcat/ \
 --iteration 120 \
 --salt 1234abcd \
 --generate-config JWS_HOME/tomcat/conf/vault.properties

The vault script used in the previous steps is also used to store sensitive strings in the password vault. The script can be run interactively or non-interactively.

When adding a string to a password vault, the sensitive string needs a name that it will be referred by. For a password vault, this name is called an attribute name, and the password itself is called a secured attribute.

The example below demonstrates using the vault script non-interactively to store a password. It uses the vault that was initialized in the previous steps, and stores the sensitive string P@SSW0#D with the attribute name manager_password.

$ JWS_HOME/tomcat/bin/tomcat-vault.sh --keystore JWS_HOME/tomcat/vault.keystore --keystore-password <vault_password> --alias my_vault --enc-dir JWS_HOME/tomcat/ --iteration 120 --salt 1234abcd --vault-block my_block --attribute manager_password --sec-attr P@SSW0#D

After storing a sensitive string in the password vault, you can refer to it in your configuration files by entering the stored string’s attribute as ${VAULT::block_name::attribute_name::}.

For example, to use the password stored in the previous steps, replace:

<user username="manager" password="P@SSW0#D" roles="manager-gui"/>

with:

<user username="manager" password="${VAULT::my_block::manager_password::}" roles="manager-gui"/>

As a result, only a reference to the password is visible in the Tomcat configuration file, and the actual password is only stored in the password vault.