Download

The System Administrator should have set up a linked directory structure like [c:]/opt/tomcat. The details of this may differ between installations so from this point on, the “root” Tomcat tomcat directory will be referred to as $TOMCAT.

Download the appropriate Tomcat 8.0 from tomcat.apache.org and unpack (unzip/uncompress) into the $TOMCAT.

Install

Some instructions are given here for installing tomcat, and making it run as a service. You should ensure that any installation meets with your company standards.

Installing on windows

Run the tomcat installation program.

Installing on

...

unix/

...

linux

...

Install the login scripts

...

Install the in tomcat login scripts in Appendix A into the tomcat user home directory. These scripts are correct as of Tomcat 8.0 but the PhixFlow consultant you should confirm that no changes are needed because of environment differences or because of different version versions of Tomcattomcat.

Installing on Windows

Run the tomcat installation program.

Anchor
configureTomcat configureTomcat

Configure tomcat

server.xml: Port Specification

Modify $TOMCAT/conf/server.xml to specify the port that PhixFlow will use (usually 8081). Find the following lines and change as needed:

<!-- Define a non-SSL HTTP/1.1 Connector on port 8080 -->

...

    <Connector

    <Connector
		port="8081"

...

		maxHttpHeaderSize="8192"

...

 ...

Remember to enable this port in the server’s firewall (if enabled).

...

Modify $TOMCAT/conf/web.xml to change the Tomcat session timeout period from its default value (30 mins). Find the following lines and change as needed:

<session-config>

...

	<session-

...

timeout>1440</session-timeout>

...

</session-config>

Update <session-timeout> to the value you need, e.g. to 1440 (minutes i.e. 1 day).

...

...

To set JVM options:

-verbose:gc

-Djava.awt.headless=true

JAVA_OPTS=

'-Xms1024m -Xmx1024m -XX:MaxPermSize=150m -verbose:gc -Djava.awt.headless=

true'

Database JDBC Drivers

The drivers needed to connect to PhixFlow’s own database are now included in the release and do not have to be downloaded separately.

...

For information on using SQLServer with Integrated Authentication, see Appendix B SQLServer Integrated Authentication.

Start Tomcat

To start Tomcat:

unix> cd

 $TOMCAT
unix> startup.sh

...

Make tomcat run as a service

Windows

• Run the Tomcat Monitor.
• Right click on the Apache Tomcat icon in the system tray and select Configure …
• On the ‘General’ tab:
• Set Startup Type to Automatic.

Unix/ Linux

As the root user, install the

...

tomcat script listed in

...

in tomcat service scripts and create a softlink to it from the appropriate run-level directory. The actual run-level directories are specific to the particular unix variant

...

You may wish to install tomcat to support secure connections over SSL.

This is described in the standard tomcat documentation - for example https://tomcat.apache.org/tomcat-8.0-doc/ssl-howto.html - but some notes are given here to get you started.

Type of certificate

If access to PhixFlow is only intended for people in your organisation, you may wish to create a self-signed certificate. This still provides a secure connection, but this will generate security warnings when users first connect, and they will not see a padlock in the address bar of their browser. If this is not acceptable to your users or by your company policy, or if you are going to provide access to people outside your organisation, you should obtain your certificate from a certificate authority (CA).

A list of certificate authorities is given on https://en.wikipedia.org/wiki/Certificate_authority.

Overview

All installations process will contain the steps:

1. Obtain a certificate - whether self-signed or from a certificate authority
2. Create a keystore
3. Tell tomcat where to find the keystore

Quick start for HTTPS access to PhixFlow

Obtain certificate and create keystore

Using the Java tool keytool you can create a self-signed certificate and a keystore in one step.

Windows

"%JAVA_HOME%\bin\keytool" -genkey -alias tomcat -keyalg RSA -keystore pathToKeystoreFile

E.g.

"%JAVA_HOME%\bin\keytool" -genkey -alias tomcat -keyalg RSA -keystore C:\app\secure\keystore

Linux

 $JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore pathToKeystoreFile

E.g.

 $JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore /opt/secure/keystore

To complete the command:

• Enter a keystore password when prompted - keystorePasswd
• Enter data about your company, contact name, etc - this information will be displayed when users access PhixFlow
• Select the default option not to set a separate password for the private key; if you want to do this, consult the tomcat documentation for further details.

Edit the tomcat configuration file

Edit the tomcat configuration file $TOMCAT/conf/server.xml as follows.

• Find the connector specification like:

<!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443         This connector uses the NIO implementation that requires the JSSE
         style configuration. When using the APR/native implementation, the
         OpenSSL style configuration is required as described in the APR/native
         documentation -->
    <!--
    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" />
    -->

and update it to:

 <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443         This connector uses the NIO implementation that requires the JSSE
         style configuration. When using the APR/native implementation, the
         OpenSSL style configuration is required as described in the APR/native
         documentation -->
    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
               keystoreFile="pathToKeystoreFile" keystorePass="keystorePasswd"
               clientAuth="false" sslProtocol="TLS" />

E.g.

 <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443         This connector uses the NIO implementation that requires the JSSE
         style configuration. When using the APR/native implementation, the
         OpenSSL style configuration is required as described in the APR/native
         documentation -->
    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
               keystoreFile="C:\app\secure\keystore" keystorePass="Hjq43823LfgreN"
               clientAuth="false" sslProtocol="TLS" />

• Restart tomcat. PhixFlow will now be available at

https://localhost:8443/phixflow

Remove standard HTTP access

Edit the tomcat configuration file $TOMCAT/conf/server.xml to comment out the standard connection.

• Update the connection like:

    <Connector port="8081" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" />

to

    <!--
         <Connector port="8081" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" />
    -->