Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 68 Current »

Linux Installation

This page explains how to set up Tomcat to run as a service under systemd. This is widely avaiable across linux distributions.

You can, however, if you wish, run tomcat under the System V init mechanism, or upstart. If you wish to do this, consult the Tomcat documentation: https://tomcat.apache.org/

Sections on this page

Download Tomcat

The System Administrator should have set up a linked directory structure like [c:]/opt/tomcat. The details of this may differ between installations so from this point on, the “root” tomcat directory will be referred to as $TOMCAT.

Download the appropriate version of Tomcat from tomcat.apache.org and unpack (unzip/uncompress) into the $TOMCAT. (Refer to System Requirements and Compatibility for supported versions).

Install Tomcat

Some instructions are given here for installing Tomcat, and making it run as a service. You should ensure that any installation meets with your company standards.

Configure Tomcat

Having completed the basic Tomcat installation, stop the Tomcat service then make the following changes:

conf/context.xml: Configure the Cache

The default Tomcat cache settings are insufficient for PhixFlow:

Edit $TOMCAT/conf/context.xml:

Add <Resources ... /> to at the end of the <Context/> block so that the file looks something like this:

<Context>
    <!-- lines omitted -->
	<Resources allowLinking="true" cachingAllowed="true" cacheMaxSize="1000000" />
</Context>

Why we recommend the cacheMaxSize

We recommend the cacheMaxSize="1000000" because Tomcat caches static files in memory so that it can respond faster. The cache has a max. size to stop it taking up too much memory. PhixFlow's static files (things like icons) are collectively too large to fit in the default cacheMaxSize, so we set it to a size that can accommodate all PhixFlow's static files.


conf/server.xml: Configure the Connector and add user to access messages


We recommend setting maxPostSize="20971520". In technical terms, this is the maximum size in bytes of the POST which will be handled by the container FORM URL parameter parsing. In practical terms, this is needed so that grids in applications in PhixFlow that hold a lot of data can be refreshed.

To configure the connector: 

  1. Edit $TOMCAT/conf/server.xml:
  2. Find the line starting <Connector port="8080".
  3. Edit the <Connector block:
    • to use the required port number (port="8080").
      Tomcat defaults to port 8080 for HTTP, but you may need to use a different port if you are running other web servers on the same host.
    • to enable compression (compression="on").
  4. After editing, the <Connector/> block should look like this:
<!-- Define a non-SSL HTTP/1.1 Connector on port 8080 -->
<Connector port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443"
           maxPostSize="20971520"
           compression="on"/>

Why we recommend compression

We recommend compression="on" because this reduces the amount of data passed between a client (the web browser on someone's computer). This setting should improve the performance of the PhixFlow front end, especially if users are going to access the front end over a slow connection.

Remember to enable this port in the server’s firewall (if enabled).

To add the user to the access messages:

  • Find the Access Log Value message pattern. This is usually near the bottom of the file and looks like:
               pattern="%h %l %u %t "%r" %s %b" />
  • Add %{username}s to the pattern to add the user into access messages - make sure you include the "s" character after the curly brackets. (These log messages appear in the system log files localhost_access_log.<date>.txt; for futher details, see Server Log Files). The pattern should now appear as:
               pattern="%h %l %u %t "%r" %{username}s %s %b" />

web.xml: Configure Session Timeout and the Secure Flag on Cookies

Session timeout

The default session timeout period is 30 minutes. You can change this to a different period e.g. 12 hours (720 minutes) by doing the following:

  1. Edit $TOMCAT/conf/web.xml
  2. Find the line containing <session-timeout.
  3. Change the session timeout period from its default value (30 mins). Once changed, it should look something like this (this example shows a 12-hour timeout).
<session-config>
	<session-timeout>720</session-timeout>
</session-config>

Secure flag on cookies

If you are going to set up an encrypted connection to PhixFlow, i.e. access via HTTPS (see /wiki/spaces/INTRANET/pages/97734787), you may also want to set the secure flag on cookies. This is a further security measure that reduces the risk of the cookies that PhixFlow creates being maliciously used to gain unauthorised access, and is a commonly used setting for web applications (https://www.owasp.org/index.php/SecureFlag). To do this, add a <cookie-config> block to the <session-config> block in the web.xml file, as in the example below.

This also sets the HTTP only flag, another common hardening measure for web applications. In fact, this is set by default, but it can be useful to explicitly set this in your configuration for clarity, and to assist with any security audits you may wish to undertake.

<session-config>
    <session-timeout>720</session-timeout>
    <cookie-config>
       <http-only>true</http-only>
       <secure>true</secure> 
    </cookie-config>
</session-config>

Pre-installed Web Applications

We recommend that you remove all web applications that are provided as part of the Tomcat installation as they are not required for PhixFlow's normal operation and constitute potential security loopholes.

These are the pre-installed web apps, in more detail.

Supplied Web ApplicationDescription
ROOTThe ROOT web application presents a very low security risk but it does include the version of Tomcat that is being used. The ROOT web application should normally be removed from a publicly accessible Tomcat instance, not for security reasons, but so that a more appropriate default page is shown to users.
DocumentationThe documentation web application presents a very low security risk but it does identify the version of Tomcat that is being used. It should normally be removed from a publicly accessible Tomcat instance.
ExamplesThe examples web application should always be removed from any security sensitive installation.
ManagerThe Manager application allows the remote deployment of web applications and is frequently targeted by attackers due to the widespread use of weak passwords and publicly accessible Tomcat instances with the Manager application enabled.
Host ManagerThe Host Manager application allows the creation and management of virtual hosts - including the enabling of the Manager application for a virtual host.

Database JDBC Drivers

The drivers needed to connect to PhixFlow’s own database are included within the release pack and no action is needed.

If you want to connect, via a Datasource, to an external database, you can rely on the bundled drivers to connect to any database that is one of PhixFlow's supported technologies and versions for its own connection - see System Requirements and Compatibility. If the external database is not covered by these, you will need to install a JDBC driver to support these connections. These JDBC drivers are available from the database suppliers, and must be placed in:

[tomcat home]/lib

For information on using SQLServer with Integrated Authentication, see MS SQL Server Integrated Authentication.

Optional: apply recommended log management

The log management configuration is only needed on long-running installations of PhixFlow. On short lived test systems, or systems that are not continually running, these are generally not required.

/wiki/spaces/INTRANET/pages/8576204867

  • No labels