Installation Guide
Install and Configure Red Hat JBoss Web Server 5.6
Abstract
Providing feedback on Red Hat documentation Copy linkLink copied to clipboard!
We appreciate your feedback on our technical content and encourage you to tell us what you think. If you’d like to add comments, provide insights, correct a typo, or even ask a question, you can do so directly in the documentation.
You must have a Red Hat account and be logged in to the customer portal.
To submit documentation feedback from the customer portal, do the following:
- Select the Multi-page HTML format.
- Click the Feedback button at the top-right of the document.
- Highlight the section of text where you want to provide feedback.
- Click the Add Feedback dialog next to your highlighted text.
- Enter your feedback in the text box on the right of the page and then click Submit.
We automatically create a tracking issue each time you submit feedback. Open the link that is displayed after you click Submit and start watching the issue or add more comments.
Thank you for the valuable feedback.
Making open source more inclusive Copy linkLink copied to clipboard!
Red Hat is committed to replacing problematic language in our code, documentation, and web properties. We are beginning with these four terms: master, slave, blacklist, and whitelist. Because of the enormity of this endeavor, these changes will be implemented gradually over several upcoming releases. For more details, see our CTO Chris Wright’s message.
Chapter 1. Introduction to Red Hat JBoss Web Server installation Copy linkLink copied to clipboard!
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. Red Hat JBoss Web Server provides a fully supported implementation of the Apache Tomcat Servlet container and the Tomcat native library.
If you need clustering or session replication support for Java applications, use Red Hat JBoss Enterprise Application Platform (JBoss EAP).
1.1. JBoss Web Server components Copy linkLink copied to clipboard!
JBoss Web Server includes components such as the Apache Tomcat Servlet container, Tomcat native library, Tomcat vault, mod_cluster library, Apache Portable Runtime (APR), and OpenSSL.
- Apache Tomcat
- Apache Tomcat is a servlet container in accordance with the Java Servlet Specification. JBoss Web Server contains Apache Tomcat 9.
- Tomcat native library
- The Tomcat native library improves Tomcat scalability, performance, and integration with native server technologies.
- Tomcat vault
- Tomcat vault is an extension for JBoss Web Server that is used for securely storing passwords and other sensitive information used by a JBoss Web Server.
- Mod_cluster
-
The
mod_clusterlibrary enables communication between Apache Tomcat and themod_proxy_clustermodule of the Apache HTTP Server. Themod_clusterlibrary enables you to use the Apache HTTP Server as a load balancer for JBoss Web Server. For more information about configuringmod_cluster, or for information about installing and configuring alternative load balancers such asmod_jkandmod_proxy, see the HTTP Connectors and Load Balancing Guide. - Apache Portable Runtime
- The Apache Portable Runtime (APR) provides superior scalability, performance, and improved integration with native server technologies. APR is a highly portable library that is at the heart of Apache HTTP Server 2.x. It enables access to: advanced IO functionality such as sendfile, epoll and OpenSSL; functionality at the operating system level such as random number generation and system status; and native process handling such as shared memory, NT pipes and UNIX sockets.
- OpenSSL
- OpenSSL is a software library that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. OpenSSL includes a basic cryptographic library.
For a full list of components that Red Hat JBoss Web Server supports, see the JBoss Web Server Component Details page.
1.2. Differences between the Apache Tomcat distributions that Red Hat provides Copy linkLink copied to clipboard!
Both Red Hat Enterprise Linux (RHEL) 7 and Red Hat JBoss Web Server provide separate distributions of Apache Tomcat.
The RHEL 8 platform subscription does not provide a distribution of Apache Tomcat. On RHEL 8, Apache Tomcat is only available as part of the Middleware Runtimes subscription.
Consider the following differences between the Apache Tomcat distributions that are available with RHEL 7 and JBoss Web Server:
- RHEL 7 provides Tomcat 7. The JBoss Web Server version 3.1 provides Tomcat 7 and Tomcat 8. The JBoss Web Server version 5.x provides Tomcat 9.
- You can install JBoss Web Server from an archive file or RPM package. You can only install the RHEL 7 distribution of Apache Tomcat from an RPM package.
Red Hat Enterprise Linux 6 is no longer supported and subsequently was removed from the documentation.
1.3. JBoss Web Server operating systems and configurations Copy linkLink copied to clipboard!
Red Hat JBoss Web Server supports different versions of the Red Hat Enterprise Linux and Microsoft Windows operating systems.
1.4. JBoss Web Server installation methods Copy linkLink copied to clipboard!
You can install Red Hat JBoss Web Server on supported Red Hat Enterprise Linux and Microsoft Windows systems by using archive installation files that are available for each platform. You can also install JBoss Web Server on supported Red Hat Enterprise Linux systems by using RPM packages.
The following components are included in the archive installation files. These components are the core parts of a JBoss Web Server installation.
jws-5.6.0-application-server.zip- Apache Tomcat 9
-
mod_cluster - Tomcat vault
jws-5.6.0-application-server-<platform>-<architecture>.zip- Platform-specific utilities
1.5. JBoss Web Server component documentation bundle Copy linkLink copied to clipboard!
JBoss Web Server includes an additional documentation bundle that includes the original vendor documentation for each component. You can download this documentation bundle, jws-docs-5.6.0.zip, from the Red Hat Customer Portal.
The documentation bundle contains additional documentation for the following components:
- Apache Tomcat
- Tomcat native library
- Tomcat vault
Chapter 2. Installing JBoss Web Server on Red Hat Enterprise Linux from archive files Copy linkLink copied to clipboard!
You can install JBoss Web Server on Red Hat Enterprise Linux from archive files or RPM packages. If you want to install JBoss Web Server from archive files, you can download and extract the JBoss Web Server archive files from the Red Hat Customer Portal.
When you install JBoss Web Server from an archive file, you can manage the product in different ways. For example, you can use a system daemon at system startup or manage JBoss Web Server from a command line.
2.1. Prerequisites Copy linkLink copied to clipboard!
- You have installed a supported Java Development Kit (JDK) by using the YUM package manager or from a compressed archive.
- Your system is compliant with Red Hat Enterprise Linux package requirements.
2.1.1. Installing a JDK by using the YUM package manager Copy linkLink copied to clipboard!
You can use the YUM package manager to install a Java Development Kit (JDK). For a full list of supported JDKs, see Supported operating systems and configurations.
Procedure
Subscribe your Red Hat Enterprise Linux system to the appropriate channel:
OpenJDK:
- rhel-7-server-rpms
- rhel-8-server-rpms
IBM:
- rhel-7-server-supplementary-rpms
- rhel-8-server-supplementary-rpms
ImportantRed Hat Enterprise Linux 6 is no longer supported and subsequently was removed from the documentation.
As the root user, execute the command to install a 1.8 JDK:
yum install java-1.8.0-<VENDOR>-devel
# yum install java-1.8.0-<VENDOR>-develCopy to Clipboard Copied! Toggle word wrap Toggle overflow Replace
<VENDOR>withibmoropenjdkRun the following commands as the root user to ensure the correct JDK is in use:
alternatives --config java
# alternatives --config javaCopy to Clipboard Copied! Toggle word wrap Toggle overflow alternatives --config javac
# alternatives --config javacCopy to Clipboard Copied! Toggle word wrap Toggle overflow These commands return lists of available JDK versions with the selected version marked with a plus (
+) sign. If the selected JDK is not the desired one, change to the desired JDK as instructed in the shell prompt.ImportantAll software that use the
javaandjavaccommands uses the JDK set byalternatives. Changing Java alternatives may impact on the running of other software.
2.1.2. Installing a JDK from a compressed archive Copy linkLink copied to clipboard!
You can install a Java Development Kit (JDK) from a compressed archive such as a .zip or .tar file. For a full list of supported JDKs, see Supported operating systems and configurations.
Procedure
-
If the JDK was downloaded from the vendor’s website (Oracle or OpenJDK), use the installation instructions provided by the vendor and set the
JAVA_HOMEenvironment variable. If the JDK was installed from a compressed, archive, set the
JAVA_HOMEenvironment variable for Tomcat:-
In the
bindirectory of Tomcat (JWS_HOME/tomcat/bin), create a file namedsetenv.sh. In the
setenv.shfile, enter theJAVA_HOMEpath definition. For example:cat JWS_HOME/tomcat/bin/setenv.sh export JAVA_HOME=/usr/lib/jvm/jre-1.8.0-openjdk.x86_64
$ cat JWS_HOME/tomcat/bin/setenv.sh export JAVA_HOME=/usr/lib/jvm/jre-1.8.0-openjdk.x86_64Copy to Clipboard Copied! Toggle word wrap Toggle overflow
-
In the
2.1.3. Red Hat Enterprise Linux package requirements Copy linkLink copied to clipboard!
Before you install JBoss Web Server on Red Hat Enterprise Linux, you must ensure that your system is compliant with the following package requirements.
The package requirements for Red Hat Enterprise Linux 7 and Red Hat Enterprise Linux 8 are different.
If you want to use OpenSSL on Red Hat Enterprise Linux 8, you must install the
opensslpackage that is provided with the operating system.To install the
opensslpackage, enter the following command as the root user:yum install openssl
# yum install opensslCopy to Clipboard Copied! Toggle word wrap Toggle overflow If you want to use Apache Portable Runtime (APR) on Red Hat Enterprise Linux 8, you must install the
aprpackage that is provided with the operating system.To install the
aprpackage, enter the following command as the root user:yum install apr
# yum install aprCopy to Clipboard Copied! Toggle word wrap Toggle overflow You must remove the
tomcatjsspackage before you install thetomcat-nativepackage. Thetomcatjsspackage uses an underlying Network Security Services (NSS) security model rather than the OpenSSL security model.To remove the
tomcatjsspackage, enter the following command as the root user:yum remove tomcatjss
# yum remove tomcatjssCopy to Clipboard Copied! Toggle word wrap Toggle overflow
-
On Red Hat Enterprise Linux 7, JBoss Web Server uses the
opensslandaprpackages that are provided with Red Hat JBoss Core Services. -
On Red Hat Enterprise Linux 8, JBoss Web Server uses the
opensslandaprpackages that are provided with the operating system. -
When you install JBoss Web Server from an archive file on Red Hat Enterprise Linux 8, you must install the
opensslandaprpackages that are provided with the operating system.
2.2. Downloading and extracting the JBoss Web Server archive file on RHEL Copy linkLink copied to clipboard!
You can download the JBoss Web Server archive file from the Red Hat Customer Portal.
Prerequisites
- You have installed a supported Java Development Kit (JDK) by using the YUM package manager or from a compressed archive.
- Your system is compliant with Red Hat Enterprise Linux package requirements.
Procedure
- Open a browser and log in to the Red Hat Customer Portal.
- Click Downloads.
- Click Red Hat JBoss Web Server in the Product Downloads list.
- Select the correct JBoss Web Server version from the Version drop-down menu.
Click Download for each of the following files, ensuring that you select the correct platform and architecture for your system:
-
The Red Hat JBoss Web Server 5.6 Application Server (
jws-5.6.0-application-server.zip). -
The Red Hat JBoss Web Server 5.6 Native Components for RHEL (
jws-5.6.0-application-server-<platform>-<architecture>.zip).
-
The Red Hat JBoss Web Server 5.6 Application Server (
Unzip the downloaded archive files to your installation directory.
For example:
unzip jws-5.5.0-application-server.zip -d /opt/ unzip -o jws-5.5.0-application-server-<platform>-<architecture>.zip -d /opt/
# unzip jws-5.5.0-application-server.zip -d /opt/ # unzip -o jws-5.5.0-application-server-<platform>-<architecture>.zip -d /opt/Copy to Clipboard Copied! Toggle word wrap Toggle overflow
The top-level directory for JBoss Web Server is created when you extract the archive. This documentation refers to the top-level directory for JBoss Web Server as JWS_HOME.
2.3. Managing JBoss Web Server by using systemd when installed from an archive file Copy linkLink copied to clipboard!
When you install JBoss Web Server from an archive file on Red Hat Enterprise Linux, you can use a system daemon to perform management tasks. Using the JBoss Web Server with a system daemon provides a method of starting the JBoss Web Server services at system startup. The system daemon also provides start, stop and status check functions.
The default system daemon for Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 7 is systemd.
Red Hat Enterprise Linux 6 is no longer supported and subsequently was removed from the documentation.
Prerequisites
Procedure
To determine which system daemon is running, enter the following command:
ps -p 1 -o comm=
$ ps -p 1 -o comm=Copy to Clipboard Copied! Toggle word wrap Toggle overflow If
systemdis running, the following output is displayed:systemd
systemdCopy to Clipboard Copied! Toggle word wrap Toggle overflow To set up the JBoss Web Server for
systemd, run the.postinstall.systemdscript as the root user:cd JWS_HOME/tomcat sh .postinstall.systemd
# cd JWS_HOME/tomcat # sh .postinstall.systemdCopy to Clipboard Copied! Toggle word wrap Toggle overflow To control the JBoss Web Server with
systemd, you can perform any of the following steps as the root user:To enable the JBoss Web Server services to start at system startup by using
systemd:systemctl enable jws5-tomcat.service
# systemctl enable jws5-tomcat.serviceCopy to Clipboard Copied! Toggle word wrap Toggle overflow To start the JBoss Web Server by using
systemd:systemctl start jws5-tomcat.service
# systemctl start jws5-tomcat.serviceCopy to Clipboard Copied! Toggle word wrap Toggle overflow NoteThe
SECURITY_MANAGERvariable is now deprecated for JBoss Web Server configurations that are based on archive file installations. Consider the following deprecation comment:SECURITY_MANAGER has been deprecated. To run tomcat under the Java Security Manager use:
# SECURITY_MANAGER has been deprecated. To run tomcat under the Java Security Manager use: JAVA_OPTS="-Djava.security.manager -Djava.security.policy==\"$CATALINA_BASE/conf/"catalina.policy\"""Copy to Clipboard Copied! Toggle word wrap Toggle overflow To stop the JBoss Web Server by using
systemd:systemctl stop jws5-tomcat.service
# systemctl stop jws5-tomcat.serviceCopy to Clipboard Copied! Toggle word wrap Toggle overflow To verify the status of the JBoss Web Server by using
systemd:systemctl status jws5-tomcat.service
# systemctl status jws5-tomcat.serviceCopy to Clipboard Copied! Toggle word wrap Toggle overflow NoteAny user can run the
statusoperation.
2.4. JBoss Web Server configuration for managing archive installations from the command line Copy linkLink copied to clipboard!
When you install JBoss Web Server from an archive file on Red Hat Enterprise Linux, you can start and stop JBoss Web Server directly from the command line. Before you can run JBoss Web Server from the command line, you must perform the following series of configuration tasks:
-
Set the
JAVA_HOMEenvironment variable for Tomcat. -
Create a
tomcatuser and its parent group. -
Grant the
tomcatuser access to JBoss Web Server.
When you manage JBoss Web Server by using a system daemon rather than from the command line, the .postinstall.systemd script performs these configuration steps automatically.
2.4.1. Setting the JAVA_HOME environment variable for Apache Tomcat Copy linkLink copied to clipboard!
Before you run JBoss Web Server from the command line for the first time, you must set the JAVA_HOME environment variable for Apache Tomcat.
Prerequisites
Procedure
-
On a command line, go to the
JWS_HOME/tomcat/bindirectory. -
Create a file named
setenv.sh. In the
setenv.shfile, enter theJAVA_HOMEpath definition.For example:
export JAVA_HOME=/usr/lib/jvm/jre-1.8.0-openjdk.x86_64
export JAVA_HOME=/usr/lib/jvm/jre-1.8.0-openjdk.x86_64Copy to Clipboard Copied! Toggle word wrap Toggle overflow
2.4.2. Creating a Tomcat user and its parent group Copy linkLink copied to clipboard!
Before you run JBoss Web Server from the command line for the first time, you must create a tomcat user and its parent group to enable simple and secure user management.
You must perform all steps in this procedure as the root user.
Prerequisites
Procedure
-
On a command line, go to the
JWS_HOMEdirectory. Create the
tomcatuser group:groupadd -g 53 -r tomcat
# groupadd -g 53 -r tomcatCopy to Clipboard Copied! Toggle word wrap Toggle overflow Create the
tomcatuser in thetomcatuser group:useradd -c "tomcat" -u 53 -g tomcat -s /sbin/nologin -r tomcat
# useradd -c "tomcat" -u 53 -g tomcat -s /sbin/nologin -r tomcatCopy to Clipboard Copied! Toggle word wrap Toggle overflow
2.4.3. Granting the Tomcat user access to JBoss Web Server Copy linkLink copied to clipboard!
Before you run JBoss Web Server from the command line for the first time, you must grant the tomcat user access to JBoss Web Server by assigning ownership of the Tomcat directories to the tomcat user.
You must perform all steps in this procedure as the root user.
Prerequisites
Procedure
-
Go to the
JWS_HOMEdirectory. Assign ownership of the Tomcat directories to the
tomcatuser:chown -R tomcat:tomcat tomcat/
# chown -R tomcat:tomcat tomcat/Copy to Clipboard Copied! Toggle word wrap Toggle overflow Ensure that the
tomcatuser has execute permissions for all parent directories:chmod -R u+X tomcat/
# chmod -R u+X tomcat/Copy to Clipboard Copied! Toggle word wrap Toggle overflow
Verification
Verify that the
tomcatuser is the owner of the directory:ls -l
# ls -lCopy to Clipboard Copied! Toggle word wrap Toggle overflow
2.5. Starting JBoss Web Server from the command line when installed from an archive file Copy linkLink copied to clipboard!
When you install JBoss Web Server from an archive file on Red Hat Enterprise Linux, you can start JBoss Web Server directly from the command line.
Prerequisites
Procedure
Enter the following command as the
tomcatuser:sh JWS_HOME/tomcat/bin/startup.sh
$ sh JWS_HOME/tomcat/bin/startup.shCopy to Clipboard Copied! Toggle word wrap Toggle overflow
2.6. Stopping JBoss Web Server from the command line when installed from an archive file Copy linkLink copied to clipboard!
When you install JBoss Web Server from an archive file on Red Hat Enterprise Linux, you can stop JBoss Web Server directly from the command line.
Prerequisites
Procedure
Enter the following command as the
tomcatuser:sh JWS_HOME/tomcat/bin/shutdown.sh
$ sh JWS_HOME/tomcat/bin/shutdown.shCopy to Clipboard Copied! Toggle word wrap Toggle overflow
2.7. SELinux policies for JBoss Web Server Copy linkLink copied to clipboard!
You can use Security-Enhanced Linux (SELinux) policies to define access controls for JBoss Web Server. These policies are a set of rules that determine access rights to the product.
2.7.1. SELinux policy information for jws5-tomcat Copy linkLink copied to clipboard!
The SELinux security model is enforced by the kernel and ensures that applications have limited access to resources such as file system locations and ports. SELinux policies ensure that any errant processes that are compromised or poorly configured are restricted or prevented from running.
The jws5-tomcat-selinux packages in your JBoss Web Server installation provide a jws5_tomcat policy. The following table contains information about the supplied SELinux policy.
| Name | Port Information | Policy Information |
|---|---|---|
|
|
Four ports in |
The
|
2.7.2. Installing SELinux policies for a JBoss Web Server archive installation Copy linkLink copied to clipboard!
In this release, the archive packages provide SELinux policies. The tomcat folder of the jws-5.6.0-application-server-<platform>-<architecture>.zip archive includes the .postinstall.selinux file. If required, you can run the .postinstall.selinux script.
Procedure
Install the
selinux-policy-develpackage:yum install -y selinux-policy-devel
yum install -y selinux-policy-develCopy to Clipboard Copied! Toggle word wrap Toggle overflow Run the
.postinstall.selinuxscript:cd <JWS_home>/tomcat/ sh .postinstall.selinux
cd <JWS_home>/tomcat/ sh .postinstall.selinuxCopy to Clipboard Copied! Toggle word wrap Toggle overflow Add access permissions to the required ports for JBoss Web Server:
semanage port -a -t http_port_t -p tcp <port>
semanage port -a -t http_port_t -p tcp <port>Copy to Clipboard Copied! Toggle word wrap Toggle overflow NoteThe JBoss Web Server has access to ports
8080,8009,8443and8005on Red Hat Enterprise Linux systems.When additional ports are required for JBoss Web Server, use the preceding
semanagecommand to provide the necessary permissions, and replace<port>with the required port.Start Tomcat:
<JWS_home>/tomcat/bin/startup.sh
<JWS_home>/tomcat/bin/startup.shCopy to Clipboard Copied! Toggle word wrap Toggle overflow Check the context of the running process expecting
jws5_tomcat:ps -eo pid,user,label,args | grep jws5_tomcat | head -n1
ps -eo pid,user,label,args | grep jws5_tomcat | head -n1Copy to Clipboard Copied! Toggle word wrap Toggle overflow Verify the contexts of the Tomcat directories. For example:
ls -lZ <JWS_home>/tomcat/logs/
ls -lZ <JWS_home>/tomcat/logs/Copy to Clipboard Copied! Toggle word wrap Toggle overflow
By default, the SElinux policy that JBoss Web Server provides is not active and the Tomcat processes run in the unconfined_java_t domain. This domain does not confine the processes.
If you choose not to enable the SELinux policy that is provided, you can take the following security measures:
-
Restrict file access for the
tomcatuser, so that thetomcatuser only has access to the files and directories that are necessary for the JBoss Web Server runtime. - Do not run Tomcat as the root user.
When JBoss Web Server is installed from an archive file, Red Hat does not officially support the use of network file sharing (NFS). If you want your JBoss Web Server installation to use an NFS-mounted file system, you are responsible for ensuring that SELinux policies are modified correctly to support this type of deployment.
Chapter 3. Installing JBoss Web Server on Red Hat Enterprise Linux from RPM packages Copy linkLink copied to clipboard!
You can install JBoss Web Server on Red Hat Enterprise Linux from archive files or RPM packages. If you want to install JBoss Web Server from RPM packages, the installation packages are available from Red Hat Subscription Management. The RPM installation option is available for Red Hat Enterprise Linux 7 and Red Hat Enterprise Linux 8.
Installing JBoss Web Server from RPM packages deploys Tomcat as a service and installs Tomcat resources into absolute paths.
3.1. Prerequisites Copy linkLink copied to clipboard!
- You have installed a supported Java Development Kit (JDK) by using the YUM package or from a compressed archive.
- Your system is compliant with Red Hat Enterprise Linux package requirements.
3.1.1. Installing a JDK by using the YUM package manager Copy linkLink copied to clipboard!
You can use the YUM package manager to install a Java Development Kit (JDK). For a full list of supported JDKs, see Supported operating systems and configurations.
Procedure
Subscribe your Red Hat Enterprise Linux system to the appropriate channel:
OpenJDK:
- rhel-7-server-rpms
- rhel-8-server-rpms
IBM:
- rhel-7-server-supplementary-rpms
- rhel-8-server-supplementary-rpms
ImportantRed Hat Enterprise Linux 6 is no longer supported and subsequently was removed from the documentation.
As the root user, execute the command to install a 1.8 JDK:
yum install java-1.8.0-<VENDOR>-devel
# yum install java-1.8.0-<VENDOR>-develCopy to Clipboard Copied! Toggle word wrap Toggle overflow Replace
<VENDOR>withibmoropenjdkRun the following commands as the root user to ensure the correct JDK is in use:
alternatives --config java
# alternatives --config javaCopy to Clipboard Copied! Toggle word wrap Toggle overflow alternatives --config javac
# alternatives --config javacCopy to Clipboard Copied! Toggle word wrap Toggle overflow These commands return lists of available JDK versions with the selected version marked with a plus (
+) sign. If the selected JDK is not the desired one, change to the desired JDK as instructed in the shell prompt.ImportantAll software that use the
javaandjavaccommands uses the JDK set byalternatives. Changing Java alternatives may impact on the running of other software.
3.1.2. Installing a JDK from a compressed archive Copy linkLink copied to clipboard!
You can install a Java Development Kit (JDK) from a compressed archive such as a .zip or .tar file. For a full list of supported JDKs, see Supported operating systems and configurations.
Procedure
-
If the JDK was downloaded from the vendor’s website (Oracle or OpenJDK), use the installation instructions provided by the vendor and set the
JAVA_HOMEenvironment variable. If the JDK was installed from a compressed, archive, set the
JAVA_HOMEenvironment variable for Tomcat:-
In the
bindirectory of Tomcat (JWS_HOME/tomcat/bin), create a file namedsetenv.sh. In the
setenv.shfile, enter theJAVA_HOMEpath definition. For example:cat JWS_HOME/tomcat/bin/setenv.sh export JAVA_HOME=/usr/lib/jvm/jre-1.8.0-openjdk.x86_64
$ cat JWS_HOME/tomcat/bin/setenv.sh export JAVA_HOME=/usr/lib/jvm/jre-1.8.0-openjdk.x86_64Copy to Clipboard Copied! Toggle word wrap Toggle overflow
-
In the
3.1.3. Red Hat Enterprise Linux package requirements Copy linkLink copied to clipboard!
Before you install JBoss Web Server on Red Hat Enterprise Linux, you must ensure that your system is compliant with the following package requirements.
The package requirements for Red Hat Enterprise Linux 7 and Red Hat Enterprise Linux 8 are different.
If you want to use OpenSSL on Red Hat Enterprise Linux 8, you must install the
opensslpackage that is provided with the operating system.To install the
opensslpackage, enter the following command as the root user:yum install openssl
# yum install opensslCopy to Clipboard Copied! Toggle word wrap Toggle overflow If you want to use Apache Portable Runtime (APR) on Red Hat Enterprise Linux 8, you must install the
aprpackage that is provided with the operating system.To install the
aprpackage, enter the following command as the root user:yum install apr
# yum install aprCopy to Clipboard Copied! Toggle word wrap Toggle overflow You must remove the
tomcatjsspackage before you install thetomcat-nativepackage. Thetomcatjsspackage uses an underlying Network Security Services (NSS) security model rather than the OpenSSL security model.To remove the
tomcatjsspackage, enter the following command as the root user:yum remove tomcatjss
# yum remove tomcatjssCopy to Clipboard Copied! Toggle word wrap Toggle overflow
-
On Red Hat Enterprise Linux 7, JBoss Web Server uses the
opensslandaprpackages that are provided with Red Hat JBoss Core Services. -
On Red Hat Enterprise Linux 8, JBoss Web Server uses the
opensslandaprpackages that are provided with the operating system. -
When you install JBoss Web Server from an archive file on Red Hat Enterprise Linux 8, you must install the
opensslandaprpackages that are provided with the operating system.
3.2. Attaching subscriptions to Red Hat Enterprise Linux Copy linkLink copied to clipboard!
Before you download and install the RPM packages for JBoss Web Server, you must register your system with Red Hat Subscription Management, and subscribe to the respective Content Delivery Network (CDN) repositories. You can subsequently perform some verification steps to ensure that a subscription provides the required CDN repositories.
Red Hat Enterprise Linux 6 is no longer supported and subsequently was removed from the documentation.
Procedure
- Log in to the Red Hat Subscription Management web page.
- Click the Systems tab.
-
Click the
Nameof the system that you want to add the subscription to. -
Change from the Details tab to the Subscriptions tab, then click
Attach Subscriptions. -
Select the check box next to the subscription you want to attach, and then click
Attach Subscriptions.
Verification
- Log in to the Red Hat Subscriptions web page.
-
In the
Subscription Namecolumn, click the subscription that you want to select. Under Products Provided, you require both of the following:
-
JBoss Enterprise Web Server -
Red Hat JBoss Core Services
-
3.3. Installing JBoss Web Server from RPM packages by using YUM Copy linkLink copied to clipboard!
You can use the YUM package manager to install JBoss Web Server from RPM packages on Red Hat Enterprise Linux.
Prerequisites
- You have installed a supported Java Development Kit (JDK).
- Your system is compliant with Red Hat Enterprise Linux package requirements.
- You have attached subscriptions to Red Hat Enterprise Linux.
Procedure
To subscribe to the JBoss Web Server CDN repositories for your operating system version, enter the following command:
subscription-manager repos --enable <repository>
# subscription-manager repos --enable <repository>Copy to Clipboard Copied! Toggle word wrap Toggle overflow NoteIn the preceding command, replace
<repository>with the following values:
-
On Red Hat Enterprise Linux 7, replace
<repository>withjws-5-for-rhel-7-server-rpmsandjb-coreservices-1-for-rhel-7-server-rpms. -
On Red Hat Enterprise Linux 8, replace
<repository>withjws-5-for-rhel-8-x86_64-rpms.
-
On Red Hat Enterprise Linux 7, replace
To install JBoss Web Server, enter the following command as the root user:
yum groupinstall jws5
# yum groupinstall jws5Copy to Clipboard Copied! Toggle word wrap Toggle overflow ImportantWhen you install JBoss Web Server from RPM packages, the
JWS_HOMEfolder is/opt/rh/jws5/root/usr/share.
-
You can install each of the packages and their dependencies individually rather than use the
groupinstallcommand. The preferred method is to usegroupinstall. - The Red Hat JBoss Core Services repositories are required for the installation of JBoss Web Server, except on Red Hat Enterprise Linux 8 systems.
- The feature to enable NFS usage by using Software Collection is enabled. For more information about this feature, see the Packaging Guide: Using Software Collections over NFS.
3.4. Starting JBoss Web Server when installed from RPMs Copy linkLink copied to clipboard!
When you install JBoss Web Server from RPM packages, you can use the commmand line to start JBoss Web Server. You can subsequently view the output of the service status command to verfiy that Tomcat is running successfully.
Red Hat Enterprise Linux 6 is no longer supported and subsequently was removed from the documentation.
Procedure
Enter the following command as the root user:
systemctl start jws5-tomcat.service
# systemctl start jws5-tomcat.serviceCopy to Clipboard Copied! Toggle word wrap Toggle overflow NoteThis is the only supported method of starting JBoss Web Server for an RPM installation.
Verification
To verify that Tomcat is running, enter the following command as any user:
systemctl status jws5-tomcat.service
# systemctl status jws5-tomcat.serviceCopy to Clipboard Copied! Toggle word wrap Toggle overflow NoteFor more information about installing and configuring HTTPD on RHEL 8, see Deploying Different Types of Server: Setting up the Apache HTTP web server.
3.5. Stopping JBoss Web Server when installed from RPMs Copy linkLink copied to clipboard!
When you install JBoss Web Server from RPM packages, you can use the command line to stop JBoss Web Server. You can subsequently view the output of the service status command to verfiy that Tomcat is running successfully.
Red Hat Enterprise Linux 6 is no longer supported and subsequently was removed from the documentation.
Procedure
Enter the followng command as the root user:
systemctl stop jws5-tomcat.service
# systemctl stop jws5-tomcat.serviceCopy to Clipboard Copied! Toggle word wrap Toggle overflow
Verification
To verify that Tomcat is no longer running, enter the following command as any user:
systemctl status jws5-tomcat.service
# systemctl status jws5-tomcat.serviceCopy to Clipboard Copied! Toggle word wrap Toggle overflow
For more information about installing and configuring HTTPD on RHEL 8, see Deploying Different Types of Server: Setting up the Apache HTTP web server.
3.6. Configuring JBoss Web Server services to start at system startup Copy linkLink copied to clipboard!
When you install JBoss Web Server from RPM packages, you can configure JBoss Web Server services to start at system startup.
Procedure
Enter the following command:
systemctl enable jws5-tomcat.service
# systemctl enable jws5-tomcat.serviceCopy to Clipboard Copied! Toggle word wrap Toggle overflow
Red Hat Enterprise Linux 6 is no longer supported and subsequently was removed from the documentation.
3.7. SELinux policies for JBoss Web Server Copy linkLink copied to clipboard!
You can use Security-Enhanced Linux (SELinux) policies to define access controls for JBoss Web Server. These policies are a set of rules that determine access rights to the product.
3.7.1. SELinux policy information for jws5-tomcat Copy linkLink copied to clipboard!
The SELinux security model is enforced by the kernel and ensures that applications have limited access to resources such as file system locations and ports. SELinux policies ensure that any errant processes that are compromised or poorly configured are restricted or prevented from running.
The jws5-tomcat-selinux packages in your JBoss Web Server installation provide a jws5_tomcat policy. The following table contains information about the supplied SELinux policy.
| Name | Port Information | Policy Information |
|---|---|---|
|
|
Four ports in |
The
|
3.7.2. Enabling SELinux policies for a JBoss Web Server RPM installation Copy linkLink copied to clipboard!
When you install JBoss Web Server from RPM packages, the jws5-tomcat-selinux package provides SELinux policies for JBoss Web Server. These packages are available in the JBoss Web Server channel.
Procedure
Install the
jws5-tomcat-selinuxpackage:yum install -y jws5-tomcat-selinux
yum install -y jws5-tomcat-selinuxCopy to Clipboard Copied! Toggle word wrap Toggle overflow
Chapter 4. Installing JBoss Web Server on Microsoft Windows Copy linkLink copied to clipboard!
You can install JBoss Web Server on Microsoft Windows from a set of archive files that you can download from the link:http://access.redhat.com{Red Hat Customer Portal].
4.1. Installing a JDK on Microsoft Windows Copy linkLink copied to clipboard!
Before you install JBoss Web Server on Microsoft Windows, you must first install a Java Development Kit (JDK).
You can download and install the JDK from a supported vendor website, such as Oracle or IBM. For a list of supported JDKs, see Supported operating systems and configurations.
This procedure describes how to install the Oracle JDK.
Procedure
To access the Oracle website, open a browser window and enter the following URL:
http://www.oracle.com/technetwork/java/javase/downloads/index.html
- Download the Oracle JDK for your operating system and architecture.
- Double-click the downloaded file to start the installation.
- Proceed as instructed in the installation window.
4.2. Downloading and extracting JBoss Web Server on Microsoft Windows Copy linkLink copied to clipboard!
You can download the JBoss Web Server archive files from the Product Downloads page on the Red Hat Customer Portal.
Prerequisites
Procedure
- Open a browser and log in to the Red Hat Product Downloads page.
- In the Product Downloads list, click Red Hat JBoss Web Server.
- In the Software Downloads page, select the correct JBoss Web Server version from the Version drop-down menu.
In the Download File table, click Download next to each of the following files:
-
The Red Hat JBoss Web Server 5.6 Application Server (
jws-5.6.0-application-server.zip). The Red Hat JBoss Web Server 5.6 Native Components for Windows Server (
jws-5.6.0-application-server-<platform>-<architecture>.zip).NoteEnsure that you select the correct file that matches the platform and architecture in your system.
-
The Red Hat JBoss Web Server 5.6 Application Server (
- Unzip the downloaded archive files to your installation directory.
The top-level directory for JBoss Web Server is created when you extract the archive. This documentation refers to the top-level directory for JBoss Web Server as JWS_HOME.
4.3. JBoss Web Server configuration on Microsoft Windows Copy linkLink copied to clipboard!
When you install JBoss Web Server on Microsoft Windows, you can manage JBoss Web Server from a command prompt or by using the Computer Management tool.
Before you can run JBoss Web Server on Microsoft Windows, you must perform the following series of configuration tasks:
4.3.1. Setting environment variables for JBoss Web Server on Microsoft Windows Copy linkLink copied to clipboard!
Before you run JBoss Web Server for the first time on Microsoft Windows, you must set the JAVA_HOME, TMP, and TEMP environment variables. You must also update the PATH environment variable.
Prerequisites
- You have installed JBoss Web Server.
Procedure
- Log in to an account with local administrator permissions.
- Click Control Panel > System.
- Click the Advanced tab.
- Click the Environment Variables button.
- Click the New button for System Variables.
-
For
JAVA_HOME,TMP, andTEMP, enter the appropriate name-value pairs for your system. To enable the SSL Connector to work successfully, add
JWS_HOME\binto thePATHenvironment variable of the user that the services will run under.NoteThe services run under the
SYSTEMuser by default.
4.3.2. Installing the Tomcat service on Microsoft Windows Copy linkLink copied to clipboard!
Before you run JBoss Web Server for the first time on Microsoft Windows, you must install the Tomcat service.
Prerequisites
Procedure
Open a command prompt with administrator privileges and go to the
binfolder for your Tomcat version:cd /D "JWS_HOME\tomcat\bin"
cd /D "JWS_HOME\tomcat\bin"Copy to Clipboard Copied! Toggle word wrap Toggle overflow Install the Tomcat service:
call service.bat install
call service.bat installCopy to Clipboard Copied! Toggle word wrap Toggle overflow
4.3.3. Configuring folder permissions for JBoss Web Server services on Microsoft Windows Copy linkLink copied to clipboard!
Before you run JBoss Web Server for the first time on Microsoft Windows, you must configure folder permissions for JBoss Web Server services. Configuring folder permissions ensures that the account that is used to run the JBoss Web Server services has full control over the JWS_HOME folder and all of its subfolders.
Prerequisites
Procedure
-
Right-click the
JWS_HOMEfolder and click Properties. - Select the Security tab.
- Click the Edit button.
- Click the Add button.
-
In the text box, enter
LOCAL SERVICE. -
Select the Full Control check box for the
LOCAL SERVICEaccount. - Click OK.
- Click the Advanced button.
-
Inside the Advanced Security Settings dialog, select
LOCAL SERVICEand click Edit. - Select the check box next to the Replace all existing inheritable permissions on all descendants with inheritable permissions from this object option.
- Click OK through all the open folder property windows to apply the settings.
4.4. Starting JBoss Web Server on Microsoft Windows Copy linkLink copied to clipboard!
When you install JBoss Web Server on Microsoft Windows, you can start the Tomcat service by using the Command Prompt or the Computer Management tool.
Prerequisites
- You have configured JBoss Web Server.
Procedure
Perform either of the following steps:
Open the Command Prompt as an administrator and enter the following command:
net start tomcat9
net start tomcat9Copy to Clipboard Copied! Toggle word wrap Toggle overflow -
Click Start > Administrative Tools > Services, right-click the
Tomcat9service, and click Start.
Some third-party applications add libraries to the system directory in Windows. These third-party libraries take precedence over Tomcat libraries during lookups. If the third-party libraries have the same name as the Tomcat native libraries, the system loads the third-party libraries rather than the libraries that are distributed with JBoss Web Server. In this situation, Tomcat might not start successfully, and Tomcat does not log any error messages in the Windows Event Log or the Tomcat log files.
If this behavior occurs, you can take the following steps:
-
To see errors, run the
catalina.bat runcommand. -
Inspect the contents of the
C:\windows\System32\directory and the otherPATHdirectories. -
Ensure that dynamic link libraries (DLLs) do not conflict with the JBoss Web Server libraries. In particular, look for the
libeay32.dll,ssleay32.dll, andlibssl32.dlllibraries.
4.5. Stopping JBoss Web Server on Microsoft Windows Copy linkLink copied to clipboard!
When you install JBoss Web Server on Microsoft Windows, you can stop the Tomcat service by using the Command Prompt or the Computer Management tool.
Prerequisites
Procedure
Perform either of the following steps:
Open the Command Prompt as an administrator and enter the following command:
net stop tomcat9
net stop tomcat9Copy to Clipboard Copied! Toggle word wrap Toggle overflow -
Go to Start > Administrative Tools > Services, right-click the
Tomcat9service, and click Stop.
Chapter 5. Configuring Hibernate for JBoss Web Server Copy linkLink copied to clipboard!
Hibernate Object/Relational Mapping (ORM) is an object-relational mapping framework that you can use to connect JBoss Web Server to Java database connectivity (JDBC) datasources. You can use Hibernate ORM with JBoss Web Server when you want to store your application data in a relational database.
5.1. Installing Hibernate ORM Copy linkLink copied to clipboard!
You can install Hibernate ORM on all platforms that JBoss Web Server supports.
Prerequisites
You have configured your project to use the JBoss Web Server Maven Repository.
NoteThe JBoss Web Server Maven Repository is available to download as
jboss-web-server-5.6.0-maven-repository.zip. from the Red Hat Software Downloads page.
Procedure
- Get the Hibernate JAR files from the JBoss Web Server Maven Repository.
- Add the Hibernate JAR files to your deployment WAR file.
5.2. Configuring JDBC connection pools Copy linkLink copied to clipboard!
Apache Tomcat provides a default connection pooling mechanism for JDBC datasources. You can configure JDBC connection pools by updating settings in the /META-INF/context.xml file for your JBoss Web Server deployment.
Procedure
-
Open the
/META-INF/context.xmlfile. Modify the JDBC connection pools that are available to applications.
For example:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
5.3. Configuring Hibernate connection properties Copy linkLink copied to clipboard!
You can configure Hibernate to use JDBC connections from the Tomcat pool, by updating settings in the /WEB-INF/classes/META-INF/persistence.xml file for your JBoss Web Server deployment.
If you want to use the Hibernate API directly, use a similar configuration to the hibernate.cfg.xml file.
Procedure
-
Open the
/WEB-INF/classes/META-INF/persistence.xmlfile. Configure Hibernate to consume connections from Tomcat.
For example:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
5.4. Adding JDBC data sources Copy linkLink copied to clipboard!
You can configure Tomcat to consume JDBC data sources, by updating settings in the /WEB-INF/web.xml file for your JBoss Web Server deployment.
Procedure
-
Open the
/WEB-INF/web.xmlfile. Configure JDBC datasources with the
resource-env-refelement.For example:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow NoteThe preceding example uses a a
jdbc/DsWebAppDBdata source.
Chapter 6. Enabling HTTP/2 for the Red Hat JBoss Web Server Copy linkLink copied to clipboard!
The Hypertext Transfer Protocols (HTTP) are standard methods of transmitting data between applications, such as servers and browsers, over the internet. JBoss Web Server supports the use of HTTP/2 for encrypted connections that are using Transport Layer Security (TLS), which is indicated by the h2 keyword when enabled.
HTTP/2 improves on HTTP/1.1 by providing the following enhancements:
- Header compression omits implied information to reduce the size of the header that is transmitted.
- Multiple requests and responses over a single connection use binary framing rather than textual framing to break down response messages.
JBoss Web Server does not support the use of HTTP/2 for unencrypted connections that are using the Transmission Control Protocol (TCP), which is indicated by the h2c keyword when enabled.
6.1. Prerequisites Copy linkLink copied to clipboard!
- You have root user access on Red Hat Enterprise Linux.
- You have installed Red Hat JBoss Web Server 5.0 or later.
You have installed the
opensslandaprpackages that are provided with Red Hat Enterprise Linux. For more information about installing theopensslandaprpackages, see Red Hat Enterprise Linux package requirements.NoteThese operating system native libraries are also provided by
jws-5.6.0-application-server-<platform>-<architecture>.zipwhere available.If you want to run JSSE+OpenSSL or APR on Red Hat Enterprise Linux 8, you must use Tomcat-Native to ensure successful operation. Tomcat-Native is located in the native archive directory.
You have configured a connector that supports the HTTP/2 protocol with SSL enabled. For JBoss Web Server 5.6, the following connectors support the HTTP/2 protocol:
- The APR Native connector (APR)
- The NIO connector with JSSE + OpenSSL (JSSE)
- The NIO2 connector with JSSE + OpenSSL (JSSE)
6.2. Enabling HTTP/2 for a connector Copy linkLink copied to clipboard!
You can enable HTTP/2 for a connector by updating settings in the server.xml configuration file.
Procedure
-
Open the
JWS_HOME/tomcat/conf/server.xmlconfiguration file. In the
server.xmlfile, add the HTTP/2 upgrade protocol to the connector.For example:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow The
server.xmlfile contains an example connector definition for the APR protocol with the upgrade protocol set to HTTP/2.For example:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow To apply the configuration updates, restart the Red Hat JBoss Web Server as the root user.
To restart JBoss Web Server on Red Hat Enterprise Linux by using
systemd, enter the following command:systemctl restart jws5-tomcat.service
# systemctl restart jws5-tomcat.serviceCopy to Clipboard Copied! Toggle word wrap Toggle overflow To restart JBoss Web Server on Red Hat Enterprise Linux by using
startup.sh, enter the following commands:JWS_HOME/sbin/shudown.sh JWS_HOME/sbin/startup.sh
# JWS_HOME/sbin/shudown.sh # JWS_HOME/sbin/startup.shCopy to Clipboard Copied! Toggle word wrap Toggle overflow To restart JBoss Web Server on Microsoft Windows, enter the following command:
net restart tomcat9
# net restart tomcat9Copy to Clipboard Copied! Toggle word wrap Toggle overflow
Red Hat Enterprise Linux 6 is no longer supported and subsequently was removed from the documentation.
6.3. Viewing JBoss Web Server logs to verify that HTTP/2 is enabled Copy linkLink copied to clipboard!
You can view the JBoss Web Server console output log to verify that HTTP/2 is enabled.
Prerequisites
- You have enabled HTTP/2 for a connector.
Procedure
To view the console output log, enter the following command:
cat JWS_HOME/tomcat/logs/catalina.out | grep 'h2'
$ cat JWS_HOME/tomcat/logs/catalina.out | grep 'h2'Copy to Clipboard Copied! Toggle word wrap Toggle overflow NoteIn the preceding command, replace
JWS_HOMEwith the top-level directory for your JBoss Web Server installation.
Verification
If HTTP/2 is enabled, the command produces the following type of output that indicates the connector has been configured to support negotiation to
[h2]:06-Apr-2018 04:49:26.201 INFO [main] org.apache.coyote.http11.AbstractHttp11Protocol.configureUpgradeProtocol The ["https-openssl-apr-8443"] connector has been configured to support negotiation to [h2] via ALPN
06-Apr-2018 04:49:26.201 INFO [main] org.apache.coyote.http11.AbstractHttp11Protocol.configureUpgradeProtocol The ["https-openssl-apr-8443"] connector has been configured to support negotiation to [h2] via ALPNCopy to Clipboard Copied! Toggle word wrap Toggle overflow
6.4. Using the curl command to verify that HTTP/2 is enabled Copy linkLink copied to clipboard!
You can use the curl command-line tool to verify that HTTP/2 is enabled.
Prerequisites
- You have enabled HTTP/2 for a connector.
You are using a version of
curlthat supports HTTP/2.To check that you are using a version of
curlthat supports HTTP/2, enter the following command:curl -V
$ curl -VCopy to Clipboard Copied! Toggle word wrap Toggle overflow This command produces the following type of output:
curl 7.55.1 (x86_64-redhat-linux-gnu) ... Release-Date: 2017-08-14 Protocols: dict file ftp ftps gopher http https ... Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz TLS-SRP HTTP2 UnixSockets HTTPS-proxy Metalink PSL
curl 7.55.1 (x86_64-redhat-linux-gnu) ... Release-Date: 2017-08-14 Protocols: dict file ftp ftps gopher http https ... Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz TLS-SRP HTTP2 UnixSockets HTTPS-proxy Metalink PSLCopy to Clipboard Copied! Toggle word wrap Toggle overflow
Procedure
To check that the HTTP/2 protocol is active, enter the following command:
curl -I http://<JBoss_Web_Server>:8080/
$ curl -I http://<JBoss_Web_Server>:8080/Copy to Clipboard Copied! Toggle word wrap Toggle overflow NoteIn the preceding example, replace <JBoss_Web_Server> with the URI of the modified connector, such as
example.com. The port number is dependent on your configuration.
Verification
If the HTTP/2 protocol is active, the
curlcommand produces the following output:HTTP/2 200
HTTP/2 200Copy to Clipboard Copied! Toggle word wrap Toggle overflow Otherwise, if the HTTP/2 protocol is inactive, the
curlcommand produces the following output:HTTP/1.1 200
HTTP/1.1 200Copy to Clipboard Copied! Toggle word wrap Toggle overflow
Chapter 7. Using a password vault with Red Hat JBoss Web Server Copy linkLink copied to clipboard!
The JBoss Web Server password vault, which is named tomcat-vault, is a PicketLink vault extension for Apache Tomcat. You can use the password vault to mask passwords and other sensitive strings, and to store sensitive information in an encrypted Java keystore. When you use the password vault, you can stop storing clear-text passwords in your Tomcat configuration files. Tomcat can use the password vault to search for passwords and other sensitive strings from a keystore.
For more information about using the CRYPT feature with the password vault, see Using CRYPT.
The Federal Information Processing Standard (FIPS) 140-2 does not support the password-based encryption that is provided by tomcat-vault. If you want to use password-based encryption on the JBoss Web Server host, you must ensure that FIPS is disabled. If you attempt to use tomcat-vault when FIPS mode is enabled, the following error message is displayed: Security Vault can’t be used in FIPS mode
7.1. Password vault installation from an archive file Copy linkLink copied to clipboard!
When you install JBoss Web Server from an archive file, the password vault is installed automatically when you install the jws-5.6.0-application-server.zip file. The password vault is located in the JWS_HOME/tomcat/lib/tomcat-vault.jar file.
7.2. Installing the password vault on RHEL by using the YUM package manager Copy linkLink copied to clipboard!
When you install JBoss Web Server on Red Hat Enterprise Linux from RPM packages, you can use the YUM package manager to install the password vault.
Procedure
Enter the following command as the root user:
yum install jws5-tomcat-vault
yum install jws5-tomcat-vaultCopy to Clipboard Copied! Toggle word wrap Toggle overflow
7.3. Enabling the password vault in JBoss Web Server Copy linkLink copied to clipboard!
You can enable the password vault by adding a configuration property in the catalina.properties file.
Prequisites
- You have installed the password vault from an archive file or by using the YUM package manager.
Procedure
- Stop Tomcat if it is already running.
-
Open the
JWS_HOME/tomcat/conf/catalina.propertiesfile. In the
catalina.propertiesfile, enter the following line:org.apache.tomcat.util.digester.PROPERTY_SOURCE=org.apache.tomcat.vault.util.PropertySourceVault
org.apache.tomcat.util.digester.PROPERTY_SOURCE=org.apache.tomcat.vault.util.PropertySourceVaultCopy to Clipboard Copied! Toggle word wrap Toggle overflow NoteIn the preceding example, replace
JWS_HOMEwith the path to your JBoss Web Server installation. The paths shown in this example use a forward slash (/) for directory separators.
7.4. Creating a Java keystore in JBoss Web Server Copy linkLink copied to clipboard!
Before you use the password vault, you must first create a Java keystore by using the keytool -genseckey command.
Procedure
Enter the following command:
keytool -genseckey -keystore JWS_HOME/tomcat/vault.keystore -alias my_vault -storetype jceks -keyalg AES -keysize 128 -storepass <vault_password> -keypass <vault_password> -validity 730
$ keytool -genseckey -keystore JWS_HOME/tomcat/vault.keystore -alias my_vault -storetype jceks -keyalg AES -keysize 128 -storepass <vault_password> -keypass <vault_password> -validity 730Copy to Clipboard Copied! Toggle word wrap Toggle overflow NoteIn the preceding example, replace the parameter settings with values that are appropriate for your environment.
For more information about each parameter, use the
keytool -genseckey -helpcommand.
The password vault does not currently support the PKCS12 keystore type. The password vault supports the JCEKS keystore type only.
Depending on the keystore algorithm that you are using, you must specify one of the following keysize values:
-
If you are using AES, specify
-keysize 128. -
If you are using DES, specify
-keysize 56. -
If you are using DESede, specify
-keysize 168.
7.5. Password vault initialization for Apache Tomcat Copy linkLink copied to clipboard!
You can use the tomcat-vault.sh script to initialize the password vault for Apache Tomcat. The tomcat-vault.sh script supports either of the following mechanisms to initialize the password vault:
7.5.1. Initializing password vault for Apache Tomcat interactively Copy linkLink copied to clipboard!
You can initialize the password vault for Tomcat interactively. In this situation, the tomcat-vault.sh script prompts you to enter values while the script is running.
Procedure
Run the
tomcat-vault.shscript and follow the on-screen prompts.For example:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow NoteIn the preceding example, replace the specified settings with values that are appropriate for your environment.
- Note the output for the Tomcat properties file. You need this information when configuring Tomcat to use the password vault.
7.5.2. Initializing password vault for Apache Tomcat by using a noninteractive setup Copy linkLink copied to clipboard!
You can initialize the password vault for Tomcat by using a noninteractive setup. In this situation, you must provide the required input as arguments to the tomcat-vault.sh script when you run the script.
Procedure
Run the
tomcat-vault.shscript and provide the required arguments.For example:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow In the preceding example, replace the specified settings with values that are appropriate for your environment.
When you specify the -g, --generate-config option, the tomcat-vault.sh script also creates a vault.properties file that contains the specified properties.
7.6. Configuring Tomcat to use the password vault Copy linkLink copied to clipboard!
You can configure Apache Tomcat to use the password vault by updating configuration settings in the vault.properties file.
Prerequisites
Procedure
-
Go to the
JWS_HOME/tomcat/conf/directory. -
Create a file named
vault.properties. In the
vault.propertiesfile, enter the vault configuration properties that you specified when you initialized the password vault for Tomcat.For example:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
The preceding example is based on the example vault settings in Initializing password vault for Apache Tomcat by using an interactive setup.
For the KEYSTORE_PASSWORD setting, ensure that you use the masked value that was generated when you initialized the password vault.
7.7. External password vault configuration Copy linkLink copied to clipboard!
You can store the vault.properties file for the password vault outside of the JWS_HOME/tomcat/conf/ directory. If you have already set a CATALINA_BASE/conf/ directory, you can store the vault.properties file in the CATALINA_BASE/conf/ directory.
For more information about setting the CATALINA_BASE directory, see the "Advanced Configuration - Multiple Tomcat Instances" section in Running The Apache Tomcat 9.0 Servlet/JSP Container on the Apache Tomcat website.
The default location for CATALINA_BASE is JWS_HOME/tomcat/. This is also known as the CATALINA_HOME directory.
Additional Resources
- Apache Tomcat 9: Introduction - Directories and Files
- Running The Apache Tomcat 9.0 Servlet/JSP Container: "Advanced Configuration - Multiple Tomcat Instances"
7.8. Storing a sensitive string in the password vault Copy linkLink copied to clipboard!
You can use the tomcat-vault.sh script to store sensitive strings in the password vault. You can run the tomcat-vault.sh script interactively or in a noninteractive mode.
When you add a sensitive string to the password vault, you must specify a name for the string. In this situation, the name of the string is called an attribute name, and the string itself is called a secured attribute.
Procedure
To use the
tomcat-vault.shscript in noninteractive mode, enter the following command:JWS_HOME/tomcat/bin/tomcat-vault.sh --keystore JWS_HOME/tomcat/vault.keystore --keystore-password <vault_password> --alias my_vault --enc-dir JWS_HOME/tomcat --iteration 120 --salt 1234abcd --vault-block my_block --attribute manager_password --sec-attr P@SSW0#D
$ JWS_HOME/tomcat/bin/tomcat-vault.sh --keystore JWS_HOME/tomcat/vault.keystore --keystore-password <vault_password> --alias my_vault --enc-dir JWS_HOME/tomcat --iteration 120 --salt 1234abcd --vault-block my_block --attribute manager_password --sec-attr P@SSW0#DCopy to Clipboard Copied! Toggle word wrap Toggle overflow
The preceding example is based on the example vault settings in Initializing password vault for Apache Tomcat by using an interactive setup. The preceding example stores the sensitive string, P@SSW0#D, with the attribute name, manager_password.
When you run the tomcat-vault.sh script, you can optionally specify a vault block to store the password in. If you do not specify a block, the tomcat-vault.sh script creates a block automatically. The preceding example specifies a vault block named my_block.
7.9. Using a stored sensitive string in your Tomcat configuration Copy linkLink copied to clipboard!
When you store a sensitive string in the password vault, you can refer to the attribute name rather than specify the actual string in your configuration files. By replacing a secured string with the attribute name for the string, you can ensure that the Tomcat configuration file contains only a reference to the password. In this situation, the actual password is stored in the password vault only.
Procedure
- Open the Tomcat configuration file that contains the sensitive string.
Replace the sensitive string with the attribute name for the string, and ensure that you enter the attribute name in the following format:
${VAULT::block_name::attribute_name::}For example:
Consider the following example file entry for the secured string,
P@SSW0#D:<user username="manager" password=*"P@SSW0#D"* roles="manager-gui"/>
<user username="manager" password=*"P@SSW0#D"* roles="manager-gui"/>Copy to Clipboard Copied! Toggle word wrap Toggle overflow If the secured string,
P@SSW0#D, has the attribute name,manager_password, replace the secured string with the following value:<user username="manager" password=*"${VAULT::my_block::manager_password::}"* roles="manager-gui"/><user username="manager" password=*"${VAULT::my_block::manager_password::}"* roles="manager-gui"/>Copy to Clipboard Copied! Toggle word wrap Toggle overflow
The preceding example is based on the example settings in Storing a sensitive string in the password vault. The preceding example replaces a sensitive string, P@SSW0#D, with an attribute name, manager_password, that is in a block called, my_block.
Chapter 8. Configuring the SSI filter Copy linkLink copied to clipboard!
You can configure filter-based Server Side Includes (SSI) support for JBoss Web Server to enable dynamic generation of content in existing HTML pages.
SSI directives do not work if you try to configure the SSI filter as in previous versions.
Procedure
-
Open the
conf/web.xmlfile. In the
web.xmlfile, uncomment the following block:<mime-mapping> <extension>shtml</extension> <mime-type>text/x-server-parsed-html</mime-type> </mime-mapping><mime-mapping> <extension>shtml</extension> <mime-type>text/x-server-parsed-html</mime-type> </mime-mapping>Copy to Clipboard Copied! Toggle word wrap Toggle overflow
Chapter 9. Configuring FIPS for Red Hat JBoss Web Server Copy linkLink copied to clipboard!
When JBoss Web Server is installed on a Red Hat Enterprise Linux 8 host, you can configure JBoss Web Server to be compliant with Federal Information Processing Standards (FIPS). When you enable FIPS on the Red Hat Enterprise Linux host, this allows JBoss Web Server to operate in FIPS mode automatically.
FIPS does not support the password-based encryption functionality that is provided by the tomcat-vault component of JBoss Web Server. If you want to use password-based encryption on the JBoss Web Server host, you must ensure that FIPS is disabled. For more information about password-based encryption and tomcat-vault, see Vault for Red Hat JBoss Web Server.
9.1. Introduction to FIPS Copy linkLink copied to clipboard!
The Federal Information Processing Standards (FIPS) provide guidelines and requirements for improving security and interoperability across computer systems and networks. The FIPS 140-2 and 140-3 series apply to cryptographic modules at both the hardware and software levels. The National Institute of Standards and Technology in the United States implements a cryptographic module validation program with searchable lists of both in-process and approved cryptographic modules.
Red Hat Enterprise Linux provides an integrated framework to enable FIPS 140-2 compliance on a system-wide basis. When operating under FIPS mode, software packages using cryptographic libraries are self-configured according to the global policy.
9.2. Configuring FIPS for JBoss Web Server on RHEL 8 Copy linkLink copied to clipboard!
You can enable FIPS compliance on the Red Hat Enterprise Linux 8 host during system installation. Alternatively, you can switch your system to FIPS mode after you have completed the system installation.
Procedure
To enable FIPS mode, complete either of the following steps:
- If you want to enable FIPS during system installation, follow the instructions in Security Hardening: Installing the system with FIPS mode enabled.
- If you want to switch to FIPS mode after system installation, follow the instructions in Security Hardening: Switching the system to FIPS mode.
Verification
Enter the following command:
fips-mode-setup --check
fips-mode-setup --checkCopy to Clipboard Copied! Toggle word wrap Toggle overflow If FIPS is enabled, this prints the following output:
FIPS mode is enabled.
FIPS mode is enabled.Copy to Clipboard Copied! Toggle word wrap Toggle overflow
Appendix A. Java IPv4 and IPv6 properties Copy linkLink copied to clipboard!
You can use Java properties to configure IPv4 and IPv6 addresses. You can subsequently export these properties to Tomcat and use address values to specify Tomcat bindings.
A.1. Overview of Java IPv4 and IPv6 properties Copy linkLink copied to clipboard!
Java provides two properties that you can use to configure IPv4 and IPv6 addresses:
- java.net.preferIPv4Stack (default: false)
-
If IPv6 is available, the underlying native socket is an IPv6 socket by default. This socket enables applications to connect and accept connections from IPv4 and IPv6 hosts. If applications use IPv4 sockets only, set this property to
true. However, applications that are using IPv4 sockets only cannot communicate with IPv6-only hosts. - java.net.preferIPv6Addresses (default: false)
-
If a host has both IPv4 and IPv6 addresses, and IPv6 is available, the default behavior is to use IPv4 addresses over IPv6. This allows backward compatibility. If applications depend on an IPv4 address representation, such as 192.168.1.1, set this property to
trueto change the preference, and use IPv6 addresses over IPv4 where possible.
A.2. Exporting Java IPv4 and IPv6 properties to Tomcat Copy linkLink copied to clipboard!
You can export Java IPv4 and IPv6 properties to Tomcat by setting CATALINA_OPTS in the JWS_HOME/tomcat/bin/setenv.* file. On Red Hat Enterprise Linux, the setenv file has a .sh extension. On Microsoft Windows, the setenv file has a .bat extension.
Procedure
If the
JWS_HOME/tomcat/bin/setenv.*file does not exist, create the file.NoteIf you are using Red Hat Enterprise Linux, create a
setenv.shfile. If you are using Microsoft Windows, create asetenv.batfile.To export Java IPv4 and IPv6 properties to Tomcat, perform either of the following steps:
If you are using Red Hat Enterprise Linux, enter the following command:
export "CATALINA_OPTS=-Djava.net.preferIPv4Stack=YOUR_VALUE -Djava.net.preferIPv6Addresses=YOUR_VALUE"
export "CATALINA_OPTS=-Djava.net.preferIPv4Stack=YOUR_VALUE -Djava.net.preferIPv6Addresses=YOUR_VALUE"Copy to Clipboard Copied! Toggle word wrap Toggle overflow If you are using Microsoft Windows, enter the following command:
set "CATALINA_OPTS=-Djava.net.preferIPv4Stack=YOUR_VALUE -Djava.net.preferIPv6Addresses=YOUR_VALUE"
set "CATALINA_OPTS=-Djava.net.preferIPv4Stack=YOUR_VALUE -Djava.net.preferIPv6Addresses=YOUR_VALUE"Copy to Clipboard Copied! Toggle word wrap Toggle overflow
A.3. Configuring Tomcat bindings Copy linkLink copied to clipboard!
You can configure Tomcat bindings in the JWS_HOME/tomcat/conf/server.xml file by specifying the IPv6 address.
Procedure
-
Open the
JWS_HOME/tomcat/conf/server.xmlfile. To specify the Tomcat binding address, enter the following details:
<Server ... address="TOMCAT_BINDING_ADDRESS">
<Server ... address="TOMCAT_BINDING_ADDRESS">Copy to Clipboard Copied! Toggle word wrap Toggle overflow To specify the HTTP connector address, enter the following details:
<Connector protocol="HTTP/1.1" ... address="HTTP_CONNECTOR_ADDRESS">
<Connector protocol="HTTP/1.1" ... address="HTTP_CONNECTOR_ADDRESS">Copy to Clipboard Copied! Toggle word wrap Toggle overflow To specify the AJP connector address, enter the following details:
<Connector protocol="AJP/1.3" ... address="AJP_CONNECTOR_ADDRESS">
<Connector protocol="AJP/1.3" ... address="AJP_CONNECTOR_ADDRESS">Copy to Clipboard Copied! Toggle word wrap Toggle overflow
Ensure that you replace TOMCAT_BINDING_ADDRESS, HTTP_CONNECTOR_ADDRESS, and AJP_CONNECTOR_ADDRESS with the correct IPv6 address.