David Ghedini's Blog

JDK 6 Update 26 Released

2011-06-12T02:59:00.000-07:00

Java Development Kit 6, update 26 has been released.

You can see the release note, bug fixes,a nd security enhancements here:

http://www.oracle.com/technetwork/java/javase/6u26releasenotes-401875.html

You can download from Oracle at:

http://www.oracle.com/technetwork/java/javase/downloads/jdk-6u26-download-400750.html

In my posts, I use the self-extracting bin file.

One simple way to upgrade your JDK is to create a new java home directory (usr/java26 for example), install the new JDK, and then update any environment settings (JAVA_HOME, etc..) as well as any scripts that reference the JAVA_HOME.

Test the new JDK and, once everything looks in order, delete the old.

Install Apache Geronimo on CentOS

2011-03-17T13:59:00.000-07:00

This post will cover installing Geronimo 2 on CentOS, RHEL, or Fedora.

In this post, we'll install the required JDK, Geronimo 2.2.1, create a Geromino start/stop script, and configure Geronimo to run as a service.

Geronimo is available with choice of Tomcat or Jetty. Except for the file names, the installation procedure is identical.

For this installation, we'll use Geronimo 2.2.1, the current, stable release.

To start, we'll install the Java Development Kit (JDK) 1.6

Geronimo 2.2.1 is certified only on Java EE 5 so you can substitute for below, but I have not had any issues with 6.

If you do have the JDK installed, you can skip to: Step 2: Download and Unpack Geronimo 2.2.1:

Step 1: Install JDK 1.6

You can download the JDK here: http://www.oracle.com/technetwork/java/javase/downloads/index.html

We'll install the latest JDK, which is JDK 6 Update 24. The JDK is specific to 32 and 64 bit versions.

My CentOS box is 64 bit, so I'll need: jdk-6u24-linux-x64.bin.

If you are on 32 bit, you'll need: jdk-6u24-linux-i586.bin

Download the appropriate JDK and save it to a directory. I'm saving it to /root.

Move (mv) or copy (cp) the file to the /opt directory:

[root@srv6 ~]# mv jdk-6u24-linux-x64.bin /opt/jdk-6u24-linux-x64.bin

Create a new directory /usr/java.

[root@srv6 ~]# mkdir /usr/java

Change to the /usr/java directory we created and install the JDK using 'sh /opt/jdk-6u24-linux-x64.bin'

[root@srv6 ~]# cd /usr/java
[root@srv6 java]# sh /opt/jdk-6u24-linux-x64.bin

Set the JAVA_HOME path. This is where we installed our JDK above.

To set it for your current session, you can issue the following from the CLI:

[root@srv6 java]# JAVA_HOME=/usr/java/jdk1.6.0_24
[root@srv6 java]# export JAVA_HOME
[root@srv6 java]# PATH=$JAVA_HOME/bin:$PATH
[root@srv6 java]# export PATH

To set the JAVA_HOME permanently, we add below to either the ~/.bashrc or ~/.bash_profile of the user (in this case, root).

We can also add it /etc/profile and then source it to give to all users.

JAVA_HOME=/usr/java/jdk1.6.0_24
export JAVA_HOME
PATH=$JAVA_HOME/bin:$PATH
export PATH

Once you have added the above to ~/.bash_profile or ~/.bashrc, you should log out, then log back in and check that the JAVA_HOME is set correctly.

[root@srv6 ~]#  echo $JAVA_HOME
/usr/java/jdk1.6.0_24

Step 2: Download and Unpack Geronimo 2.2.1

Download geronimo-tomcat6-javaee5-2.2.1 here

If you want to use the embedded Jetty version, download geronimo-jetty7-javaee5-2.2.1 from the same page as above.

Again, the only difference in installation is the file names, so just adjust accordingly.

Save the file to a directory. I'm saving it to /root/geronimo-tomcat6-javaee5-2.2.1-bin.tar.gz

Before proceeding, you should verify the MD5 Checksum for your Geronimo download.

Since we saved the Geronimo download to /root/geronimo-tomcat6-javaee5-2.2.1-bin.tar.gz, we'll go to the /root directory and use the md5sum command.

[root@srv6 ~]# md5sum geronimo-tomcat6-javaee5-2.2.1-bin.tar.gz
0bb2985421398eb2b4af35ce4eaff974  geronimo-tomcat6-javaee5-2.2.1-bin.tar.gz

Compare the output above to the MD5 Checksum provided by the Geronimo Tomcat MD5 page and insure that they match exactly.

Now, move (mv) or copy (cp) the file to the /usr/share directory:

[root@srv6 ~]# mv geronimo-tomcat6-javaee5-2.2.1-bin.tar.gz /usr/share/geronimo-tomcat6-javaee5-2.2.1-bin.tar.gz

Change to the /usr/share directory and unpack the file using tar -xzf:

[root@srv6 ~]# cd /usr/share
[root@sv2 srv6 ]# tar -xzf geronimo-tomcat6-javaee5-2.2.1-bin.tar.gz

This will create the directory /usr/share/geronimo-tomcat6-javaee5-2.2.1

Step 3: Configure Geronimo to Run as a Service.

We will now create a simple Start/Stop/Restart script and configure Geronimo to run as a service.

Naviagte to the /etc/init.d directory and create a script called 'geronimo' as shown below.

[root@srv6 share]# cd /etc/init.d
[root@srv6 init.d]# vi geronimo

The script:

#!/bin/bash
# description: Geronimo Start Stop Restart
# processname: geronimo
# chkconfig: 234 20 80
JAVA_HOME=/usr/java/jdk1.6.0_24
export JAVA_HOME
PATH=$JAVA_HOME/bin:$PATH
export PATH
GERONIMO_HOME=/usr/share/geronimo-tomcat6-javaee5-2.2.1

case $1 in
start)
sh $GERONIMO_HOME/bin/startup.sh
;; 
stop)   
sh $GERONIMO_HOME/bin/shutdown.sh
;; 
restart)
sh $GERONIMO_HOME/bin/shutdown.sh
sh $GERONIMO_HOME/bin/startup.sh
;; 
esac    
exit 0

As you can see, we are simply calling the startup.sh and shutdown.sh scripts located in the Geronimo bin directory (/usr/share/geronimo-tomcat6-javaee5-2.2.1/bin).

GERONIMO_HOME is the Geronimo home directory where we unpacked at (/usr/share/geronimo-tomcat6-javaee5-2.2.1)

Now, make the geronimo script executable:

[root@srv6 init.d]# chmod 755 geronimo

Add Geronimo to chkconfig and set to start at boot.

[root@srv6 init.d]# chkconfig --add geronimo
[root@srv6 init.d]# chkconfig --level 234 geronimo on

Verify it:

[root@srv6 init.d]# chkconfig --list geronimo
tomcat          0:off   1:off   2:on    3:on    4:on    5:off   6:off

Now, we can start Geronimo using 'service geronimo start':

Start Geronimo:

[root@srv6 ~]# service geronimo start
Using GERONIMO_HOME:   /usr/share/geronimo-tomcat6-javaee5-2.2.1
Using GERONIMO_TMPDIR: var/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_24/jre
Using GERONIMO_OUT:    /usr/share/geronimo-tomcat6-javaee5-2.2.1/var/log/geronimo.out

Geronimo started in background. PID: 5179

You should now be able to navigate to http://yourdomain.com:8080 or http://yourIPaddress:8080 and we should see the Geronimo home page.

Step 4: Access Geronimo Admin Console and Change Password.

To access the Geronimo Admin Console, click the 'Console' link under Administration on the home page or simply navigate to http://yourdomain.com:8080/console or http://yourIPaddress:8080/console.

The default user name and password is system/manager.

Logged in as system:

To change the default password, in the Console Navigation menu, expand the Security node and then click on 'Users and Groups'

Click the Edit link for the user System and update the password.

Step 5 (optional): Modify Script to Pass the System Password Value.

Stopping Geronimo.

Using our script above, when stopping Geronimo using 'service geronimo stop', we will be prompted for the system password:

[root@srv6 init.d]# service geronimo stop
Using GERONIMO_HOME:   /usr/share/geronimo-tomcat6-javaee5-2.2.1
Using GERONIMO_TMPDIR: var/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_24/jre
Username: system
Password: *******
Locating server on localhost:1099... Server found.
Server shutdown started
Server shutdown completed

We can modify our script, however, to pass the password to the shell by adding '--user system --password manager' to the shutdown command:

#!/bin/bash
# description: Geronimo Start Stop Restart
# processname: geronimo
# chkconfig: 234 20 80
JAVA_HOME=/usr/java/jdk1.6.0_24
export JAVA_HOME
PATH=$JAVA_HOME/bin:$PATH
export PATH
GERONIMO_HOME=/usr/share/geronimo-tomcat6-javaee5-2.2.1

case $1 in
start)
sh $GERONIMO_HOME/bin/startup.sh
;; 
stop)   
sh $GERONIMO_HOME/bin/shutdown.sh --user system --password manager
;; 
restart)
sh $GERONIMO_HOME/bin/shutdown.sh --user system --password manager
sh $GERONIMO_HOME/bin/startup.sh
;; 
esac    
exit 0

**In the script above, I am using the default system/manager password above, but don't forget to use the new password you created for the system user in the console in Step 4 above.

You can also create a new role and user if you wish to.

Now, when we stop Geronimo using 'service geronimo stop' we are no longer prompted for the password:

Stop Geronimo:

[root@srv6 init.d]# service geronimo stop
Using GERONIMO_HOME:   /usr/share/geronimo-tomcat6-javaee5-2.2.1
Using GERONIMO_TMPDIR: var/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_24/jre
Locating server on localhost:1099... Server found.
Server shutdown started
Server shutdown completed

Learn More About Apache Geronimo

Apache Geronimo
Geronimo Documentation Wiki

Install JBoss 6 on CentOS

2011-03-12T15:52:00.000-08:00

This post will cover installing JBoss 6.0 on CentOS 5.x.

We'll also set up JBoss to run as a service, as well as secure the JMX and Web Service consoles.

While there are similarities to JBoss 5.1 installation, the file locations have changed in some instances.

Here is an outline of the steps we will follow:

1. Download and Install the Java Development Kit (JDK)
2. Download and Install JBoss 6.0 Application Server
3. Create the user, jboss, who will own and run JBoss
4. Set the required JAVA_HOME and JBOSS_HOME paths
5. Create a start/stop/restart script for JBoss
6. Configure JBoss to run as a service
7. Access the JBoss Admin console
8. Change the JBoss Admin Password
9. Secure the JMX Console
10. Securing the Web Service Console
11. Set memory parameters for JBoss using JAVA_OPTS
12. Configure JBoss to run on port 80

Step 1: Download and Install the Java Development Kit (JDK)

You can download the JDK here: http://www.oracle.com/technetwork/java/javase/downloads/index.html

I'm using JDK 6, update 26, the latest as of this post. The JDK is specific to 32 and 64 bit versions.

My CentOS box is 64 bit, so I'll need: jdk-6u26-linux-x64.bin

If you are on 32 bit, you'll need: jdk-6u26-linux-i586.bin

Download the appropriate JDK and save it to a directory. I'm saving it to /root.

Move (mv) or copy (cp) the file to the /opt directory:

[root@sv2 ~]# mv jdk-6u26-linux-x64.bin /opt/jdk-6u26-linux-x64.bin

Create the directory /usr/java.

[root@sv2 ~]# mkdir /usr/java

Change to the /usr/java directory we created and install the JDK using 'sh /opt/jdk-6u26-linux-x64.bin'

[root@sv2 ~]# cd /usr/java
[root@sv2 java]# sh /opt/jdk-6u26-linux-x64.bin

We now have the JDK installed at /usr/java/jdk1.6.0_26. We'll use this for our JAVA_HOME a bit later in step

Step 2: Download and Install JBoss 6.0 Application Server

Download jboss-6.0.0.Final.zip at http://sourceforge.net/projects/jboss/files/JBoss/jboss-6.0.0.Final/ or use wget:

[root@sv2 ~]# wget http://sourceforge.net/projects/jboss/files/JBoss/JBoss-6.0.0.Final/jboss-as-distribution-6.0.0.Final.zip/download
.
.
.
100%[======================================>] 181,267,148  816K/s   in 3m 31s

2011-03-13 00:56:44 (839 KB/s) - `jboss-as-distribution-6.0.0.Final.zip' saved [181267148/181267148]

Move (mv) or copy (cp) the file to /usr/share/jboss-6.0.0.Final.zip.

[root@sv2 ~]# mv jboss-as-distribution-6.0.0.Final.zip /usr/share/jboss-as-distribution-6.0.0.Final.zip

Change to the /usr/share directory and unzip the file:

[root@sv2 ~]# cd /usr/share
[root@sv2 share]# unzip -q jboss-as-distribution-6.0.0.Final.zip

The unzip will create the following directory: /usr/share/jboss-6.0.0.Final

This directory will be our JBOSS_HOME, which we will use below in Step 4.

Step 3: Create the user, jboss, who will own and run JBoss

Since we will want to run JBoss as a non-root user with minimal privileges, we'll create a user, jboss, who will own the JBoss files and JBoss will run under his account.

To do this, we can need to the following.

Create a new group, jboss, and then create the user jboss and add the user to the jboss group.

[root@sv2 ~]# groupadd jboss
[root@sv2 ~]# useradd -s /bin/bash -g jboss jboss

Change ownership of the JBoss home directory, /usr/share/jboss-6.0.0.Final so all files are owned by the user jboss we created.

[root@sv2 ~]# chown -Rf jboss.jboss /usr/share/jboss-6.0.0.Final/

Step 4: Set the required JAVA_HOME and JBOSS_HOME paths

We no need to set the JAVA_HOME and JBOSS_HOME.

The JAVA_HOME is where we installed the JDK above, /usr/java/jdk1.6.0_26, and the JBOSS_HOME is where we installed JBoss above /usr/share/jboss-6.0.0.Final.

Add the following to the jboss users .bash_profile:

JAVA_HOME=/usr/java/jdk1.6.0_26
export JAVA_HOME
PATH=$JAVA_HOME/bin:$PATH
export PATH
JBOSS_HOME=/usr/share/jboss-6.0.0.Final
export JBOSS_HOME

To set the JAVA_HOME for users, we add this to the user ~/.bashrc or ~/.bash_profile of the user. We can also add it /etc/profile and then source it to give to all users.

JAVA_HOME=/usr/java/jdk1.6.0_26 
export JAVA_HOME 
PATH=$JAVA_HOME/bin:$PATH 
export PATH

Once you have added the above to ~/.bash_profile or ~/.bashrc, you should su to the user jboss and verify that the JAVA_HOME and JBOSS_HOME are set correctly.

[root@sv2 ~]#  su jboss
[jboss@sv2 ~]#  echo $JAVA_HOME
/usr/java/jdk1.6.0_26
[jboss@sv2 ~]#  echo $JBOSS_HOME
/usr/share/jboss-6.0.0.Final

Step 5: Create a start/stop/restart script for JBoss.

For our JBoss script we will simply copy the existing jboss_init_redhat.sh script located at at /usr/share/jboss-6.0.0.Final/bin, copy it to /etc/init.d and rename it to 'jboss':

So, as root:

[root@sv2 ~]# cd /usr/share/jboss-6.0.0.Final/bin 
[root@sv2 bin]# cp jboss_init_redhat.sh /etc/init.d/jboss

In the jboss script (shown completed below), make the following changes:

1. Add lines 3,4, and 5:

# description: JBoss Start Stop Restart
# processname: jboss
# chkconfig: 234 20 80

2. Line 22, Set the JBOSS_HOME to where we unpacked JBoss in step 2 above:
JBOSS_HOME=${JBOSS_HOME:-"/usr/share/jboss-6.0.0.Final"}

3. Line 28. Set the JAVA_HOME to where we installed the JDK in step 1 above:
JAVAPTH=${JAVAPTH:-"/usr/java/jdk1.6.0_26"}

4. Add line 34, which sets the JBOSS_HOST to 0.0.0.0, allowing JBoss to bind to any IP.
JBOSS_HOST="0.0.0.0"

#!/bin/sh
#
# description: JBoss Start Stop Restart
# processname: jboss6
# chkconfig: 234 20 80
#
# $Id: jboss_init_redhat.sh 81068 2008-11-14 15:14:35Z dimitris@jboss.org $
#
# JBoss Control Script
#
# To use this script run it as root - it will switch to the specified user
#
# Here is a little (and extremely primitive) startup/shutdown script
# for RedHat systems. It assumes that JBoss lives in /usr/local/jboss,
# it's run by user 'jboss' and JDK binaries are in /usr/local/jdk/bin.
# All this can be changed in the script itself. 
#
# Either modify this script for your requirements or just ensure that
# the following variables are set correctly before calling the script.

#define where jboss is - this is the directory containing directories log, bin, conf etc
JBOSS_HOME=${JBOSS_HOME:-"/usr/share/jboss-6.0.0.Final"}

#define the user under which jboss will run, or use 'RUNASIS' to run as the current user
JBOSS_USER=${JBOSS_USER:-"jboss"}

#make sure java is in your path
JAVAPTH=${JAVAPTH:-"/usr/java/jdk1.6.0_26"}

#configuration to use, usually one of 'minimal', 'default', 'all'
JBOSS_CONF=${JBOSS_CONF:-"default"}

#if JBOSS_HOST specified, use -b to bind jboss services to that address
JBOSS_HOST="0.0.0.0"
JBOSS_BIND_ADDR=${JBOSS_HOST:+"-b $JBOSS_HOST"}

#define the classpath for the shutdown class
JBOSSCP=${JBOSSCP:-"$JBOSS_HOME/bin/shutdown.jar:$JBOSS_HOME/client/jnet.jar"}

#define the script to use to start jboss
JBOSSSH=${JBOSSSH:-"$JBOSS_HOME/bin/run.sh -c $JBOSS_CONF $JBOSS_BIND_ADDR"}

if [ "$JBOSS_USER" = "RUNASIS" ]; then
  SUBIT=""
else
  SUBIT="su - $JBOSS_USER -c "
fi

if [ -n "$JBOSS_CONSOLE" -a ! -d "$JBOSS_CONSOLE" ]; then
  # ensure the file exists
  touch $JBOSS_CONSOLE
  if [ ! -z "$SUBIT" ]; then
    chown $JBOSS_USER $JBOSS_CONSOLE
  fi 
fi

if [ -n "$JBOSS_CONSOLE" -a ! -f "$JBOSS_CONSOLE" ]; then
  echo "WARNING: location for saving console log invalid: $JBOSS_CONSOLE"
  echo "WARNING: ignoring it and using /dev/null"
  JBOSS_CONSOLE="/dev/null"
fi

#define what will be done with the console log
JBOSS_CONSOLE=${JBOSS_CONSOLE:-"/dev/null"}

JBOSS_CMD_START="cd $JBOSS_HOME/bin; $JBOSSSH"
JBOSS_CMD_STOP=${JBOSS_CMD_STOP:-"java -classpath $JBOSSCP org.jboss.Shutdown --shutdown"}

if [ -z "`echo $PATH | grep $JAVAPTH`" ]; then
  export PATH=$PATH:$JAVAPTH
fi

if [ ! -d "$JBOSS_HOME" ]; then
  echo JBOSS_HOME does not exist as a valid directory : $JBOSS_HOME
  exit 1
fi

echo JBOSS_CMD_START = $JBOSS_CMD_START

case "$1" in
start)
    cd $JBOSS_HOME/bin
    if [ -z "$SUBIT" ]; then
        eval $JBOSS_CMD_START >${JBOSS_CONSOLE} 2>&1 &
    else
        $SUBIT "$JBOSS_CMD_START >${JBOSS_CONSOLE} 2>&1 &" 
    fi
    ;;
stop)
    if [ -z "$SUBIT" ]; then
        $JBOSS_CMD_STOP
    else
        $SUBIT "$JBOSS_CMD_STOP"
    fi 
    ;;
restart)
    $0 stop
    $0 start
    ;;
*)
    echo "usage: $0 (start|stop|restart|help)"
esac

Step 6: Run JBoss as a Service.

To run JBoss as a service and enable start up at boot, make the script we created above executable and add it to our chkconfig so it starts at boot.

[root@sv2 init.d]# chmod 755 jboss
[root@sv2 init.d]# chkconfig --add jboss
[root@sv2 init.d]# chkconfig --level 234 jboss on

We should now be able to Start, Stop, and Restart JBoss as a service.

Start JBoss:

Note: JBoss can take some time to start.

[root@sv2 init.d]# service jboss start
JBOSS_CMD_START = cd /usr/share/jboss-6.0.0.Final/bin; /usr/share/jboss-6.0.0.Final/bin/run.sh -c default -b 0.0.0.0

Stop JBoss:

[root@sv2 init.d]# service jboss stop
JBOSS_CMD_START = cd /usr/share/jboss-6.0.0.Final/bin; /usr/share/jboss-6.0.0.Final/bin/run.sh -c default -b 0.0.0.0
Shutdown message has been posted to the server.
Server shutdown may take a while - check logfiles for completion

Step 7: Access the JBoss Admin.

Make sure JBoss is started and you should now be able to access the Jboss Console at:

http://yourdomain.com:8080 or http://yourip:8080

The default user name and password for the JBoss Admin Console is admin/admin

Access the Admin Console by clicking on the Administration Console link.

Step 8: Change the JBoss Admin Password

To change the default Admin Console password, go to:

/usr/share/jboss-6.0.0.Final/server/default/conf/props

Open the jmx-console-users.properties file in text editor and change the password.

# A sample users.properties file for use with the UsersRolesLoginModule
admin=MyPassword

Step 9: Secure the JMX Console

To secure the JMX Console, go to:

/usr/share/jboss-6.0.0.Final/common/deploy/jmx-console.war/WEB-INF

First, edit the web.xml file. Towards the bottom, you will find the security-constraint as shown below:

<!-- A security constraint that restricts access to the HTML JMX console
   to users with the role JBossAdmin. Edit the roles to what you want and
   uncomment the WEB-INF/jboss-web.xml/security-domain element to enable
   secured access to the HTML JMX console.
   <security-constraint>
     <web-resource-collection>
       <web-resource-name>HtmlAdaptor</web-resource-name>
       <description>An example security config that only allows users with the
         role JBossAdmin to access the HTML JMX console web application
       </description>
       <url-pattern>/*</url-pattern>
     </web-resource-collection>
     <auth-constraint>
       <role-name>JBossAdmin</role-name>
     </auth-constraint>
   </security-constraint>
   -->

Un-comment the security-constraint section so it appears thus:

<security-constraint>
     <web-resource-collection>
       <web-resource-name>HtmlAdaptor</web-resource-name>
       <description>An example security config that only allows users with the
         role JBossAdmin to access the HTML JMX console web application
       </description>
       <url-pattern>/*</url-pattern>
     </web-resource-collection>
     <auth-constraint>
       <role-name>JBossAdmin</role-name>
     </auth-constraint>
   </security-constraint>

Next, still in the WEB-INF directory, edit the jboss-web.xml file, which will look as below:

<!DOCTYPE jboss-web PUBLIC
   "-//JBoss//DTD Web Application 5.0//EN"
   "http://www.jboss.org/j2ee/dtd/jboss-web_5_0.dtd">
   
<jboss-web>
   <!-- Uncomment the security-domain to enable security. You will
      need to edit the htmladaptor login configuration to setup the
      login modules used to authentication users.
      <security-domain>java:/jaas/jmx-console</security-domain>
   -->
</jboss-web>

Uncomment the security-domain so it appears thus:

<!DOCTYPE jboss-web PUBLIC
   "-//JBoss//DTD Web Application 5.0//EN"
   "http://www.jboss.org/j2ee/dtd/jboss-web_5_0.dtd">
   
<jboss-web>
   
      <security-domain>java:/jaas/jmx-console</security-domain>
   
</jboss-web>

At this point, the password for the JMX Console will be the same as the password we set for the Admin Console in step 8 above.

Both the Admin Console and JMX Console are are using the jmx-console-roles.properties and jmx-console-users.properties files.

Step 10: Secure the Web Service Console

To secure the Web Service Console, go to:

/usr/share/jboss-6.0.0.Final/common/deploy/jbossws-console.war/WEB-INF

First, edit the web.xml file. Towards the bottom, you will find the security-constraint as shown below:

<!-- A security constraint that restricts access
   <security-constraint>
     <web-resource-collection>
       <web-resource-name>ContextServlet</web-resource-name>
       <description>An example security config that only allows users with the
         role 'friend' to access the JBossWS console web application
       </description>
       <url-pattern>/*</url-pattern>
     </web-resource-collection>
     <auth-constraint>
       <role-name>friend</role-name>
     </auth-constraint>
   </security-constraint>
   -->

Un-comment the security-constraint section so it appears thus:

<security-constraint>
     <web-resource-collection>
       <web-resource-name>ContextServlet</web-resource-name>
       <description>An example security config that only allows users with the
         role 'friend' to access the JBossWS console web application
       </description>
       <url-pattern>/*</url-pattern>
     </web-resource-collection>
     <auth-constraint>
       <role-name>friend</role-name>
     </auth-constraint>
   </security-constraint>

Next, still in the WEB-INF directory, edit the jboss-web.xml file, which will look as below:

<?xml version="1.0" encoding="ISO-8859-1"?>

<!DOCTYPE jboss-web
    PUBLIC "-//JBoss//DTD Web Application 2.3V2//EN"
    "http://www.jboss.org/j2ee/dtd/jboss-web_3_2.dtd">

<jboss-web>

  <!-- A security domain that restricts access
  <security-domain>java:/jaas/JBossWS</security-domain>
  -->
  
  <context-root>jbossws</context-root>

</jboss-web>

Uncomment the security-domain so it appears thus:

<?xml version="1.0" encoding="ISO-8859-1"?>

<!DOCTYPE jboss-web
    PUBLIC "-//JBoss//DTD Web Application 2.3V2//EN"
    "http://www.jboss.org/j2ee/dtd/jboss-web_3_2.dtd">

<jboss-web>

 
  <security-domain>java:/jaas/JBossWS</security-domain>
 
  
  <context-root>jbossws</context-root>

</jboss-web>

The default user name and password are kermit/thefrog

To change this, go to:

/usr/share/jboss-6.0.0.Final/server/default/conf/props

Open jbossws-roles.properties in a text editor it should appear as below.

# A sample roles.properties file for use with the UsersRolesLoginModule
kermit=friend

Change 'kermit' to a new user name. For example, we'll change it to 'mywsuser' as shown below:

# A sample roles.properties file for use with the UsersRolesLoginModule
mywsuser=friend

Open jbossws-users.properties in a text editor it should appear as below.

# A sample users.properties file for use with the UsersRolesLoginModule
kermit=thefrog

Change 'kermit' to our new user name 'mywsuser' and change the password. For example, we'll change the password to it to 'MyWsPassword' as shown below:

# A sample users.properties file for use with the UsersRolesLoginModule
mywsuser=MyWsPassword

Step 11: Set JAVA_OPTS Memory Parameters

To set the memory limits for JBoss,

Got to: /usr/share/jboss-6.0.0.Final/bin

Open the run.sh file in a text editor.

Find the section below:

# Setup JBoss specific properties
JAVA_OPTS="-Dprogram.name=$PROGNAME $JAVA_OPTS"

Directly below this, add the desired parameters.

# Setup JBoss specific properties
JAVA_OPTS="-Dprogram.name=$PROGNAME $JAVA_OPTS"
JAVA_OPTS="$JAVA_OPTS -Xms128m -Xmx256m"

I'm installing this on a small VPS so I'm using JAVA_OPTS="$JAVA_OPTS -Xms128m -Xmx256m". You should set this to whatever is appropriate to your server and application.

Step 12: Running JBoss on Port 80.

To run services below port 1024 as user other than root, you can use port forwarding.

You can do this by adding the following to your IP tables:

[root@sv2 ~]# iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
[root@sv2 ~]# iptables -t nat -A PREROUTING -p udp -m udp --dport 80 -j REDIRECT --to-ports 8080

Be sure to save and then restart your IP Tables for the above to take effect.

Happy JBoss'ing.

Install JBoss 5.1 on CentOS

2011-03-12T13:36:00.000-08:00

This post will cover installing JBoss 5.1 on CentOS 5.x.

We'll also set up JBoss to run as a service

I did my installation below on CentOS 5.5. This should work for RHEL and Fedora as well.

Firstly, let's outline the steps we will be taking:

1. Download and Install the Java Development Kit (JDK)
2. Download and Install JBoss 5.1 Application Server
3. Create the user, jboss, who will own and run JBoss
4. Set the required JAVA_HOME and JBOSS_HOME paths
5. Create a start/stop/restart script for JBoss
6. Configure JBoss to run as a service
7. Change the JBoss Admin Console password
8. Set memory parameters for JBoss using JAVA_OPTS
9. Configure JBoss to run on port 80
10. Notes: Securing the JMX Console, Web Console, JBossWS, and Tomcat Status.

Step 1: Download and Install the Java Development Kit (JDK)

You can download the JDK here: http://www.oracle.com/technetwork/java/javase/downloads/index.html

I'm using JDK 6, update 24, the latest as of this post. The JDK is specific to 32 and 64 bit versions.

My CentOS box is 64 bit, so I'll need: jdk-6u24-linux-x64.bin.

If you are on 32 bit, you'll need: jdk-6u24-linux-i586.bin

Download the appropriate JDK and save it to a directory. I'm saving it to /root.

Move (mv) or copy (cp) the file to the /opt directory:

[root@sv2 ~]# mv jdk-6u24-linux-x64.bin /opt/jdk-6u24-linux-x64.bin

Create the directory /usr/java.

[root@sv2 ~]# mkdir /usr/java

Change to the /usr/java directory we created and install the JDK using 'sh /opt/jdk-6u24-linux-x64.bin'

[root@sv2 ~]# cd /usr/java
[root@sv2 java]# sh /opt/jdk-6u24-linux-x64.bin

We now have the JDK installed at /usr/java/jdk1.6.0_24. We'll use this for our JAVA_HOME a bit later in step

Step 2: Download and Install JBoss 5.1 Application Server

Download jboss-5.1.0.GA.zip at http://sourceforge.net/projects/jboss/files/JBoss/JBoss-5.1.0.GA/ or use wget:

[root@aoukuk25 ~]# wget http://sourceforge.net/projects/jboss/files/JBoss/JBoss-5.1.0.GA/jboss-5.1.0.GA.zip/download
.
.
.
Saving to: `jboss-5.1.0.GA.zip'

100%[======================================>] 133,466,607 5.58M/s   in 17s

2011-01-02 02:03:02 (7.56 MB/s) - `jboss-5.1.0.GA.zip' saved [133466607/133466607]
[root@sv2 ~]#

Move (mv) or copy (cp) the file to /usr/share/jboss-5.1.0.GA.zip.

[root@sv2 ~]# mv jboss-5.1.0.GA.zip /usr/share/jboss-5.1.0.GA.zip

Change to the /usr/share directory and unzip the file:

[root@sv2 ~]# cd /usr/share
[root@sv2 share]# unzip -q jboss-5.1.0.GA.zip

The unzip will create the following directory: /usr/share/jboss-5.1.0.GA

This directory will be our JBOSS_HOME, which we will use below in Step 4 below

Step 3: Create the user, jboss, who will own and run JBoss

[root@sv2 ~]# groupadd jboss
[root@sv2 ~]# useradd -s /bin/bash -g jboss jboss

Change ownership of the JBoss home directory, /usr/share/jboss-5.1.0.GA so all files are owned by the user jboss we created.

[root@sv2 ~]# chown -Rf jboss.jboss /usr/share/jboss-5.1.0.GA/

Step 4: Set the required JAVA_HOME and JBOSS_HOME paths

We no need to set the JAVA_HOME and JBOSS_HOME.

The JAVA_HOME is where we installed the JDK above, /usr/java/jdk1.6.0_24, and the JBOSS_HOME is where we installed JBoss above /usr/share/jboss-5.1.0.GA.

Add the following to the jboss users .bash_profile:

JAVA_HOME=/usr/java/jdk1.6.0_24
export JAVA_HOME
PATH=$JAVA_HOME/bin:$PATH
export PATH
JBOSS_HOME=/usr/share/jboss-5.1.0.GA
export JBOSS_HOME

To set the JAVA_HOME for users, we add this to the user ~/.bashrc or ~/.bash_profile of the user. We can also add it /etc/profile and then source it to give to all users.

JAVA_HOME=/usr/java/jdk1.6.0_24 
export JAVA_HOME 
PATH=$JAVA_HOME/bin:$PATH 
export PATH

Once you have added the above to ~/.bash_profile or ~/.bashrc, you should su to the user jboss and verify that the JAVA_HOME and JBOSS_HOME are set correctly.

[root@sv2 ~]#  su jboss
[jboss@sv2 ~]#  echo $JAVA_HOME
/usr/java/jdk1.6.0_24
[jboss@sv2 ~]#  echo $JBOSS_HOME
/usr/share/jboss-5.1.0.GA

Step 5: Create a start/stop/restart script for JBoss.

For our JBoss script we will simply copy the existing jboss_init_redhat.sh script located at at /usr/share/jboss-5.1.0.GA/bin, copy it to /etc/init.d and rename it to 'jboss':

So, as root:

[root@sv2 ~]# cd /usr/share/jboss-5.1.0.GA/bin 
[root@sv2 bin]# cp jboss_init_redhat.sh /etc/init.d/jboss

In the jboss script (shown completed below), make the following changes:

1. Add lines 3,4, and 5:

# description: JBoss Start Stop Restart
# processname: jboss
# chkconfig: 234 20 80

2. Line 21, Set the JBOSS_HOME to where we unpacked JBoss in step 2 above:
JBOSS_HOME=${JBOSS_HOME:-"/usr/share/jboss-5.1.0.GA"}

3. Line 27. Set the JAVA_HOME to where we installed the JDK in step 1 above:
JAVAPTH=${JAVAPTH:-"/usr/java/jdk1.6.0_24"}

4. Add line 33, which sets the JBOSS_HOST to 0.0.0.0, allowing JBoss to bind to any IP.
JBOSS_HOST="0.0.0.0"

#!/bin/sh
#
# description: JBoss Start Stop Restart
# processname: jboss
# chkconfig: 234 20 80
# $Id: jboss_init_redhat.sh 81068 2008-11-14 15:14:35Z dimitris@jboss.org $
#
# JBoss Control Script
#
# To use this script run it as root - it will switch to the specified user
#
# Here is a little (and extremely primitive) startup/shutdown script
# for RedHat systems. It assumes that JBoss lives in /usr/local/jboss,
# it's run by user 'jboss' and JDK binaries are in /usr/local/jdk/bin.
# All this can be changed in the script itself. 
#
# Either modify this script for your requirements or just ensure that
# the following variables are set correctly before calling the script.

#define where jboss is - this is the directory containing directories log, bin, conf etc
JBOSS_HOME=${JBOSS_HOME:-"/usr/share/jboss-5.1.0.GA"}

#define the user under which jboss will run, or use 'RUNASIS' to run as the current user
JBOSS_USER=${JBOSS_USER:-"jboss"}

#make sure java is in your path
JAVAPTH=${JAVAPTH:-"/usr/java/jdk1.6.0_24"}

#configuration to use, usually one of 'minimal', 'default', 'all'
JBOSS_CONF=${JBOSS_CONF:-"default"}

#if JBOSS_HOST specified, use -b to bind jboss services to that address
JBOSS_HOST="0.0.0.0"
JBOSS_BIND_ADDR=${JBOSS_HOST:+"-b $JBOSS_HOST"}


#define the classpath for the shutdown class
JBOSSCP=${JBOSSCP:-"$JBOSS_HOME/bin/shutdown.jar:$JBOSS_HOME/client/jnet.jar"}

#define the script to use to start jboss
JBOSSSH=${JBOSSSH:-"$JBOSS_HOME/bin/run.sh -c $JBOSS_CONF $JBOSS_BIND_ADDR"}

if [ "$JBOSS_USER" = "RUNASIS" ]; then
  SUBIT=""
else
  SUBIT="su - $JBOSS_USER -c "
fi

if [ -n "$JBOSS_CONSOLE" -a ! -d "$JBOSS_CONSOLE" ]; then
  # ensure the file exists
  touch $JBOSS_CONSOLE
  if [ ! -z "$SUBIT" ]; then
    chown $JBOSS_USER $JBOSS_CONSOLE
  fi 
fi

if [ -n "$JBOSS_CONSOLE" -a ! -f "$JBOSS_CONSOLE" ]; then
  echo "WARNING: location for saving console log invalid: $JBOSS_CONSOLE"
  echo "WARNING: ignoring it and using /dev/null"
  JBOSS_CONSOLE="/dev/null"
fi

#define what will be done with the console log
JBOSS_CONSOLE=${JBOSS_CONSOLE:-"/dev/null"}

JBOSS_CMD_START="cd $JBOSS_HOME/bin; $JBOSSSH"
JBOSS_CMD_STOP=${JBOSS_CMD_STOP:-"java -classpath $JBOSSCP org.jboss.Shutdown --shutdown"}

if [ -z "`echo $PATH | grep $JAVAPTH`" ]; then
  export PATH=$PATH:$JAVAPTH
fi

if [ ! -d "$JBOSS_HOME" ]; then
  echo JBOSS_HOME does not exist as a valid directory : $JBOSS_HOME
  exit 1
fi

echo JBOSS_CMD_START = $JBOSS_CMD_START

case "$1" in
start)
    cd $JBOSS_HOME/bin
    if [ -z "$SUBIT" ]; then
        eval $JBOSS_CMD_START >${JBOSS_CONSOLE} 2>&1 &
    else
        $SUBIT "$JBOSS_CMD_START >${JBOSS_CONSOLE} 2>&1 &" 
    fi
    ;;
stop)
    if [ -z "$SUBIT" ]; then
        $JBOSS_CMD_STOP
    else
        $SUBIT "$JBOSS_CMD_STOP"
    fi 
    ;;
restart)
    $0 stop
    $0 start
    ;;
*)
    echo "usage: $0 (start|stop|restart|help)"
esac

Step 6: Run JBoss as a Service.

To run JBoss as a service and enable start up at boot, make the script we created above executable and add it to our chkconfig so it starts at boot.

[root@sv2 init.d]# chmod 755 jboss
[root@sv2 init.d]# chkconfig --add jboss
[root@sv2 init.d]# chkconfig --level 234 jboss on

We should now be able to Start, Stop, and Restart JBoss as a service.

Start JBoss:

Note: JBoss can take some time to start.

[root@sv2 init.d]# service jboss start
JBOSS_CMD_START = cd /usr/share/jboss-5.1.0.GA/bin; /usr/share/jboss-5.1.0.GA/bin/run.sh -c default -b 0.0.0.0

Stop JBoss:

[root@sv2 init.d]# service jboss stop
JBOSS_CMD_START = cd /usr/share/jboss-5.1.0.GA/bin; /usr/share/jboss-5.1.0.GA/bin/run.sh -c default -b 0.0.0.0
Shutdown message has been posted to the server.
Server shutdown may take a while - check logfiles for completion

Make sure JBoss is started and you should now be able to access the Jboss Console at:

http://yourdomain.com:8080 or http://yourip:8080

If you have any difficulties, check the logs and also insure that port 8080 is open

Step 7: Change the Admin Console Pasword.

The default user name and password for the JBoss Admin Console is admin/admin

To change the password, go to:

/usr/share/jboss-5.1.0.GA/server/default/conf/props

Edit the jmx-console-users.properties file, shown below

# A sample users.properties file for use with the UsersRolesLoginModule
admin=admin

The user name is at left and the password at right. Change the password to something hard to guess ;-)

Step 8: Set JAVA_OPTS Memory Parameters

To set the memory limits for JBoss,

Got to: /usr/share/jboss-5.1.0.GA/bin

Open the run.sh file in a text editor.

Find the section below:

# Setup JBoss specific properties
JAVA_OPTS="-Dprogram.name=$PROGNAME $JAVA_OPTS"

Directly below this, add the desired parameters.

# Setup JBoss specific properties
JAVA_OPTS="-Dprogram.name=$PROGNAME $JAVA_OPTS"
JAVA_OPTS="$JAVA_OPTS -Xms128m -Xmx256m"

I'm installing this on a small VPS so I'm using JAVA_OPTS="$JAVA_OPTS -Xms128m -Xmx256m". You should set this to whatever is appropriate to your server and application.

Step 9: Running JBoss on Port 80.

To run services below port 1024 as user other than root, you can use port forwarding.

You can do this by adding the following to your IP tables:

[root@sv2 ~]# iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
[root@sv2 ~]# iptables -t nat -A PREROUTING -p udp -m udp --dport 80 -j REDIRECT --to-ports 8080

Step 10: Notes: Secure the JBoss Web Console, JMX Console, JBossWS, and Tomcat Status Page.

This section will cover some simple and most basic methods of securing the consoles.

If you are simply running JBoss locally to have a look at it, you can skip this bit.

I've seen more elegent presentations of securing JBoss, so you may want to Google this if you find below a bit clunky.

As with anything related to your application and server security, please consult the docs.

Step 10a: Secure the JMX Console.

To secure the JMX Console, go to:
/usr/share/jboss-5.1.0.GA/server/default/deploy/jmx-console.war/WEB-INF

First, edit the web.xml file. Towards the bottom, you will find the security-constraint as shown below:

<!-- A security constraint that restricts access to the HTML JMX console
   to users with the role JBossAdmin. Edit the roles to what you want and
   uncomment the WEB-INF/jboss-web.xml/security-domain element to enable
   secured access to the HTML JMX console.
   <security-constraint>
     <web-resource-collection>
       <web-resource-name>HtmlAdaptor</web-resource-name>
       <description>An example security config that only allows users with the
         role JBossAdmin to access the HTML JMX console web application
       </description>
       <url-pattern>/*</url-pattern>
       <http-method>GET</http-method>
       <http-method>POST</http-method>
     </web-resource-collection>
     <auth-constraint>
       <role-name>JBossAdmin</role-name>
     </auth-constraint>
   </security-constraint>
   -->

Un-comment the security-constraint section so it appears thus:

<security-constraint>
     <web-resource-collection>
       <web-resource-name>HtmlAdaptor</web-resource-name>
       <description>An example security config that only allows users with the
         role JBossAdmin to access the HTML JMX console web application
       </description>
       <url-pattern>/*</url-pattern>
       <http-method>GET</http-method>
       <http-method>POST</http-method>
     </web-resource-collection>
     <auth-constraint>
       <role-name>JBossAdmin</role-name>
     </auth-constraint>
   </security-constraint>

Next, still in the WEB-INF directory, edit the jboss-web.xml file, which will look as below:

<!DOCTYPE jboss-web PUBLIC
   "-//JBoss//DTD Web Application 5.0//EN"
   "http://www.jboss.org/j2ee/dtd/jboss-web_5_0.dtd">
   
<jboss-web>
   <!-- Uncomment the security-domain to enable security. You will
      need to edit the htmladaptor login configuration to setup the
      login modules used to authentication users.
      <security-domain>java:/jaas/jmx-console</security-domain>
   -->
</jboss-web>

Uncomment the security-domain so it appears thus:

<jboss-web>
   
      <security-domain>java:/jaas/jmx-console</security-domain>
   
</jboss-web>

At this point, the password for the JMX Console will be the same as the password we set for the Admin Console at in in step 7a above. Both are using the java:/jaas/jmx-console security domain.

You can, of course change this if you wish to create a stronger solution.

Step 10b: Secure the Web Console.

To secure the Web Console, go to:

/usr/share/jboss-5.1.0.GA/server/default/deploy/management/console-mgr.sar/web-console.war/WEB-INF

As with the JMX Console, in the WEB-INF.xml un-comment the security constraint so it appears thus:

<security-constraint>
   <web-resource-collection>
   <web-resource-name>HtmlAdaptor</web-resource-name>
   <description>An example security config that only allows users with the
   role JBossAdmin to access the HTML JMX console web application
   </description>
   <url-pattern>/*</url-pattern>
   <http-method>GET</http-method>
   <http-method>POST</http-method>
   </web-resource-collection>
   <auth-constraint>
   <role-name>JBossAdmin</role-name>
   </auth-constraint>
   </security-constraint>

Still in the WEB-INF directory, go to the jboss-web.xml file.

By default, The jboss-web.xml file will appear as below:

<?xml version='1.0' encoding='UTF-8' ?>
 
<!DOCTYPE jboss-web
    PUBLIC "-//JBoss//DTD Web Application 2.3V2//EN"
    "http://www.jboss.org/j2ee/dtd/jboss-web_3_2.dtd">

<jboss-web>

   <!-- Uncomment the security-domain to enable security. You will
   need to edit the htmladaptor login configuration to setup the
   login modules used to authentication users.
   <security-domain>java:/jaas/web-console</security-domain>
   -->

   <!-- The war depends on the -->
   <depends>jboss.admin:service=PluginManager</depends>
</jboss-web>

Un-comment the security-domain so it appears thus:

<jboss-web>
   
   <security-domain>java:/jaas/web-console</security-domain>
  

   
   <depends>jboss.admin:service=PluginManager</depends>
</jboss-web>

Now, we need to make a change to the go to login-config.xml file located under /usr/share/jboss-5.1.0.GA/server/default/conf/

Open the login-config.xml and look for the section below:

<application-policy name="web-console">
    <authentication>
      <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule" flag="required">
        <module-option name="usersProperties">web-console-users.properties</module-option>
        <module-option name="rolesProperties">web-console-roles.properties</module-option>
      </login-module>
    </authentication>
  </application-policy>

Add 'props/' to the path of the web-console-users.properties and web-console-roles.properties

So the section will now appear thus:

<application-policy name="web-console">
    <authentication>
      <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule" flag="required">
        <module-option name="usersProperties">props/web-console-users.properties</module-option>
        <module-option name="rolesProperties">props/web-console-roles.properties</module-option>
      </login-module>
    </authentication>
  </application-policy>

Finally, go to /root/jboss-5.1.0.GA/server/default/conf/props and create the following files:

1. web-console-roles.properties

The web-console-roles.properties file should contain the following:

admin=JBossAdmin,HttpInvoker

2. web-console-users.properties

The web-console-users.properties file should contain the following:

admin=WebSecret

Where 'WebSecret' is whatever you would like the password to be. If you wish to be able to access the Web Console with the same password as for the Admin and JMX console, simply use the same password here.

Step 10c: Secure the JBossWS.

The procedure for securing the JBossWS is virtually identical to securing the JMX-Console, save the difference in file loactions.

To secure the JBossWS, go to:
/usr/share/jboss-5.1.0.GA/server/default/deploy/jbossws.sar/jbossws-management.war/WEB-INF

First, edit the web.xml file. Locate the security-constraint (about half-way down the file), and un-comment it so it appears thus:

<security-constraint>
     <web-resource-collection>
       <web-resource-name>ContextServlet</web-resource-name>
       <description>An example security config that only allows users with the
         role 'friend' to access the JBossWS console web application
       </description>
       <url-pattern>/*</url-pattern>
       <http-method>GET</http-method>
       <http-method>POST</http-method>
     </web-resource-collection>
     <auth-constraint>
       <role-name>friend</role-name>
     </auth-constraint>
   </security-constraint>

Next, still in the WEB-INF directory, edit the jboss-web.xml file.

Un-comment the security-domain so it appears thus:

<?xml version="1.0" encoding="ISO-8859-1"?>

<!DOCTYPE jboss-web
    PUBLIC "-//JBoss//DTD Web Application 2.3V2//EN"
    "http://www.jboss.org/j2ee/dtd/jboss-web_3_2.dtd">

<jboss-web>

  
  <security-domain>java:/jaas/JBossWS</security-domain>
 
  
  <context-root>jbossws</context-root>

</jboss-web>

In the /props directory you will find the jbossws-roles.properties and jbossws-users.properties files.

The default role is 'friend' with user name 'Kermit' and password 'the frog'

jbossws-roles.properties:

# A sample roles.properties file for use with the UsersRolesLoginModule
kermit=friend

jbossws-users.properties:

# A sample users.properties file for use with the UsersRolesLoginModule
kermit=thefrog

Change the user name and password.

Step 10d: Secure the Tomcat Status Page.

Many would recommend simply disabling the Tomcat Status.

If you wish to secure it, however, go to:

/usr/share/jboss-5.1.0.GA/server/default/deploy/ROOT.war/WEB-INF

Just before the closing web-app tag add the following to the end of the web.xml file:

<security-constraint>  
    <security-constraint>
     <web-resource-collection>
       <web-resource-name>HtmlAdaptor</web-resource-name>
       <description>An example security config that only allows users with the
         role JBossAdmin to access the HTML JMX console web application
       </description>
       <url-pattern>/status</url-pattern>
       <http-method>GET</http-method>
       <http-method>POST</http-method>
     </web-resource-collection>
     <auth-constraint>
       <role-name>TomcatStatus</role-name>
     </auth-constraint>
   </security-constraint>


   <login-config>
      <auth-method>BASIC</auth-method>
      <realm-name>TomcatStatus</realm-name>
   </login-config>

   <security-role>
      <role-name>TomcatStatus</role-name>
   </security-role>

Your web.xml file should now look thus:

<?xml version="1.0" encoding="ISO-8859-1"?>

<!DOCTYPE web-app
    PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
    "http://java.sun.com/dtd/web-app_2_3.dtd">

<web-app>
  <display-name>Welcome to JBoss</display-name>
  <description>
     Welcome to JBoss
  </description>
  <servlet>
    <servlet-name>Status Servlet</servlet-name>
    <servlet-class>org.jboss.web.tomcat.service.StatusServlet</servlet-class>
  </servlet>
  <servlet-mapping>
    <servlet-name>Status Servlet</servlet-name>
    <url-pattern>/status</url-pattern>
  </servlet-mapping>



<security-constraint>
     <web-resource-collection>
       <web-resource-name>HtmlAdaptor</web-resource-name>
       <description>An example security config that only allows users with the
         role JBossAdmin to access the HTML JMX console web application
       </description>
       <url-pattern>/status</url-pattern>
       <http-method>GET</http-method>
       <http-method>POST</http-method>
     </web-resource-collection>
     <auth-constraint>
       <role-name>TomcatStatus</role-name>
     </auth-constraint>
   </security-constraint>


   <login-config>
      <auth-method>BASIC</auth-method>
      <realm-name>TomcatStatus</realm-name>
   </login-config>

   <security-role>
      <role-name>TomcatStatus</role-name>
   </security-role>



</web-app>

Still in the /usr/share/jboss-5.1.0.GA/server/default/deploy/ROOT.war/ directory, create a jboss-web.xml file with the following contents:

<jboss-web>  
      
       <security-domain>java:/jaas/tomcat-status</security-domain>  
      
</jboss-web>

Go to /usr/share/jboss-5.1.0.GA/server/default/conf

Look for the following section:

<application-policy name="web-console">
    <authentication>
      <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"
        flag="required">
        <module-option name="usersProperties">props/web-console-users.properties</module-option>
        <module-option name="rolesProperties">props/web-console-roles.properties</module-option>
      </login-module>
    </authentication>
  </application-policy>

Directly under this section, add the following entry:

<application-policy name="tomcat-status">
    <authentication>
      <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"
        flag="required">
        <module-option name="usersProperties">props/tomcat-status-users.properties</module-option>
        <module-option name="rolesProperties">props/tomcat-status-roles.properties</module-option>
      </login-module>
    </authentication>
  </application-policy>

Now, in the /usr/share/jboss-5.1.0.GA/server/default/conf/props directory, create the following two files:

1. tomcat-status-roles.properties

The tomcat-status-roles.properties file should contain the following:

admin=TomcatStatus

2. tomcat-status-users.properties

The tomcat-status-users.properties file should contain the following:

admin=TomcatSecret

Where 'TomcatSecret' is whatever you would like the password to be. If you wish to be able to access the Web Console with the same password as for the Admin and JMX console, simply use the same password here.

Again, you may find it simpler to just disable the Tomcat Status.

http://community.jboss.org/

Installing GlassFish 3.1 on CentOS or RHEL

2011-03-08T07:21:00.000-08:00

GlassFish 3.1 has been released.

I've created a post for installing GlassFish 3.1 on CentOS/RHEL which you can find on my new Roller Blog here:

http://www.davidghedini.com/pg/entry/install_glassfish_3_1_on

It is basically the same procedure as GlassFish 3.0.1, with some minor changes.

You can find my GlassFish 3.0.1 post in this blog
as well as at my new Roller blog: http://www.davidghedini.com/pg/entry/how_to_install_glassfish_3

HTH.

Install Apache Roller 4 on CentOS and Tomcat

2011-02-10T16:02:00.000-08:00

This post will cover installing Apache Roller 4.0.1 on CentOS with Tomcat and MySQL.

4.0.1 is the current GA production release of Apache Roller.

For this post, you will need a working installation of Tomcat. If you do not have Tomcat installed, you can install it using our Tomcat step-by-step guide here.

What you will need to download:

apache-roller-4.0.1.zip
JavaMail 1.4.4
mysql-connector-java-5.1.15-bin.jar

I'll be saving the above file to my /opt directory.

1. Create the Required MySQL Database and User:

We'll call our database 'roller'

[root@srv6 opt]# mysql -u root -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 2694
Server version: 5.0.77 Source distribution

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> create database roller;
Query OK, 1 row affected (0.00 sec)

mysql> grant all on roller.* to myuser@localhost identified by 'secret';
Query OK, 0 rows affected (0.00 sec)

mysql>

2. Copy The Required JAR Files to the Tomcat/lib Directory

From our downloads, we'll need to copy the mail.jar and mysql-connector-java-5.1.15-bin.jar to our Tomcat/lib Directory

Unzip javamail1_4_4.zip

[root@srv6 opt]# unzip -q javamail1_4_4.zip

Change to the javamail-1.4.4 directory and copy mail.jar to the Tomcat lib directory:

[root@srv6 opt]# cd javamail-1.4.4
[root@srv6 javamail-1.4.4]# cp mail.jar /usr/share/apache-tomcat-6.0.30/lib/mail.jar

Change back to the /opt directory and unpack mysql-connector-java-5.1.15.tar.gz

[root@srv6 javamail-1.4.4]# cd /opt
[root@srv6 opt]# tar -xvf mysql-connector-java-5.1.15.tar.gz

Change to the mysql-connector-java-5.1.15 directory and copy mysql-connector-java-5.1.15-bin.jar to the Tomcat lib directory:

[root@srv6 opt]# cd mysql-connector-java-5.1.15
[root@srv6 mysql-connector-java-5.1.15]# cp mysql-connector-java-5.1.15-bin.jar /usr/share/apache-tomcat-6.0.30/lib/mysql-connector-java-5.1.15-bin.jar

3. Create a roller-custom.properties File

We'll now create our roller-custom.properties file in the Tomcat/lib directory

[root@srv6 mysql-connector-java-5.1.15]#  cd /usr/share/apache-tomcat-6.0.30/lib
[root@srv6 lib]# vi roller-custom.properties

The file should contain the following. Replace database, user and password with your own. If required enter the mail user credentials as well.

installation.type=auto
database.configurationType=jdbc
database.jdbc.driverClass=com.mysql.jdbc.Driver
database.jdbc.connectionURL=jdbc:mysql://localhost:3306/roller
database.jdbc.username=myuser
database.jdbc.password=secret
mail.configurationType=properties
mail.hostName=localhost
#mail.username=
#mail.password=

4. Create roller.war

We now need to build the roller.war file from our Roller download.

Unzip apache-roller-4.0.1.zip

[root@srv6 opt]# unzip -q apache-roller-4.0.1.zip

Change to the apache-roller-4.0.1/webapp/roller directory

[root@srv6 opt]# cd apache-roller-4.0.1/webapp/roller

Create the WAR file

[root@srv6 roller]# % jar cvf ../roller.war *

5. Copy the roller.war to your Tomcat/webapps Directory

The roller.war file is created apache-roller-4.0.1/webapp directory. Copy the WAR to your Tomcat/webapps directory

[root@srv6 webapp]# cp roller.war /usr/share/apache-tomcat-6.0.30/webapps/roller.war

6. Start Tomcat

Start up Tomcat to load your new files and jars.

[root@srv6 webapp]# service tomcat start
Using CATALINA_BASE:   /usr/share/apache-tomcat-6.0.30
Using CATALINA_HOME:   /usr/share/apache-tomcat-6.0.30
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-6.0.30/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_23
Using CLASSPATH:       /usr/share/apache-tomcat-6.0.30/bin/bootstrap.jar

7. Create Roller Tables in MySQL via Roller GUI

If your installation was successful, you should now be able to go to http://YourIP:8080/roller or http://YourDomain:8080/roller

If you are not able to access Roller, check your catalina.out or roller.log files in your Tomcat/logs directory.

You should see a prompt to create the roller tables in MySQL.

Click the "Yes - Create Tables Now" button

On successful completion of creating the Roller tables in MySQL you will see the following:

Follow the prompt and click to complete the installation.

8. Create Global Admin User

The Roller Front Page should now be displayed as below.

Click the 'New User Registration Link' to create your Global Admin user. As noted, the first user registered will have Global Admin rights.

http://roller.apache.org/

Install Mondrian OLAP 3.2 on CentOS with Tomcat and MySQL

2011-02-09T03:45:00.000-08:00

This post will cover installing Mondrian OLAP Engine on CentOS with Tomcat and MySQL.

Mondrian 3.2.0.13661
Tomcat 6.0.30
MySQL 5.0.77

This post assumes you have a working Tomcat installation. If you do not, please follow our step-by-step tutorial to installing Tomcat 6 or Tomcat 7.

You will need to download the following:

Mondrian: mondrian-3.2.0.13661.zip
http://sourceforge.net/projects/mondrian/files/mondrian/mondrian-3.2.0.13661-GA/

Apache Axis 1.4: axis-bin-1_4.tar.gz
http://www.apache.org/dyn/closer.cgi/ws/axis/1_4

MySQL Connector J (if not already installed): mysql-connector-java-5.1.14.tar.gz
http://www.mysql.com/downloads/connector/j/

1. Download the Above Files to the /opt Directory.

Unzip mondrian-3.2.0.13661.zip

[root@srv6 opt]# unzip -q mondrian-3.2.0.13661.zip

Unpack Axis 1.4

[root@srv6 opt]# tar xzf axis-bin-1_4.tar.gz

Unpack mysql-connector-java-5.1.14.tar.gz

[root@srv6 opt]# tar xzf mysql-connector-java-5.1.14.tar.gz

In your /opt directory you should now have:

[root@srv6 opt]# ls
axis-1_4                mondrian-3.2.0.13661
mysql-connector-java-5.1.14

2. Deploy Mondrian to the Tomcat_Home/webapps folder.

Naviagte to /opt/mondrian-3.2.0.13661/lib

You can use one of two methods to deploy the mondrian.war to Tomcat_Home/webapps:

Method 1. Copy or mv the Modrian.WAR file from /opt/mondrian-3.2.0.13661/lib to your Tomcat/webapps directory and restart Tomcat to deploy the WAR.

[root@srv6 opt]# cp /opt/mondrian-3.2.0.13661/lib/mondrian.war /usr/share/apache-tomcat-6.0.30/webapps/mondrian.war
[root@srv6 opt]# service tomcat start (or restart)

Method 2. Create the mondrian directory under Tomcat_Home/webapps and manually and explode the WAR via the CLI

[root@srv6 opt]# mkdir /usr/share/apache-tomcat-6.0.30/webapps/mondrian
[root@srv6 opt]# cp /opt/mondrian-3.2.0.13661/lib/mondrian.war /usr/share/apache-tomcat-6.0.30/webapps/mondrian/mondrian.war
[root@srv6 opt]# cd /usr/share/apache-tomcat-6.0.30/webapps/mondrian
[root@srv6 mondrian]# jar -xvf mondrian.war

3. Copy the Required Jars from Axis and MySQL to the Mondrain Directory Created Above

There are four JAR files we need from /opt/axis-1_4/lib:

axis.jar
commons-discovery-0.2.jar
wsdl4j-1.5.1.jar
jaxrpc.jar

Copy or move these JAR file to /mondrian/WEB-INF/lib:

[root@srv6 mondrian]# cd /opt/axis-1_4/lib
[root@srv6 lib]# cp axis.jar /usr/share/apache-tomcat-6.0.30/webapps/mondrian/WEB-INF/lib/axis.jar
[root@srv6 lib]# cp commons-discovery-0.2.jar /usr/share/apache-tomcat-6.0.30/webapps/mondrian/WEB-INF/lib/commons-discovery-0.2.jar
[root@srv6 lib]# cp wsdl4j-1.5.1.jar /usr/share/apache-tomcat-6.0.30/webapps/mondrian/WEB-INF/lib/wsdl4j-1.5.1.jar
[root@srv6 lib]# cp jaxrpc.jar /usr/share/apache-tomcat-6.0.30/webapps/mondrian/WEB-INF/lib/jaxrpc.jar

Copy or move the MySQL Connector to /usr/share/apache-tomcat-6.0.30/webapps/mondrian/WEB-INF/lib

[root@srv6 lib]# cp /opt/mysql-connector-java-5.1.14/mysql-connector-java-5.1.14-bin.jar /usr/share/apache-tomcat-6.0.30/webapps/mondrian/WEB-INF/lib/mysql-connector-java-5.1.14-bin.jar

4. Restart Tomcat

[root@srv6 ~]# service tomcat restart
Using CATALINA_BASE:   /usr/share/apache-tomcat-6.0.30
Using CATALINA_HOME:   /usr/share/apache-tomcat-6.0.30
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-6.0.30/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_23
Using CLASSPATH:       /usr/share/apache-tomcat-6.0.30/bin/bootstrap.jar
Using CATALINA_BASE:   /usr/share/apache-tomcat-6.0.30
Using CATALINA_HOME:   /usr/share/apache-tomcat-6.0.30
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-6.0.30/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_23
Using CLASSPATH:       /usr/share/apache-tomcat-6.0.30/bin/bootstrap.jar

5. Create the Foodmart Database and Database User:

[root@srv6 lib]# mysql -u root -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 10
Server version: 5.0.77 Source distribution

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> create database foodmart
    -> ;
Query OK, 1 row affected (0.02 sec)

mysql> grant all privileges on *.* to 'foodmart'@'localhost' identified by 'foodmart';
Query OK, 0 rows affected (0.02 sec)

mysql>

6. Load the Foodmart Sample Data.

java -cp "/usr/share/apache-tomcat-6.0.30/webapps/mondrian/WEB-INF/lib/mondrian.jar:/usr/share/apache-tomcat-6.0.30/webapps/mondrian/WEB-INF/lib/log4j-1.2.8.jar:/usr/share/apache-tomcat-6.0.30/webapps/mondrian/WEB-INF/lib/commons-logging-1.0.4.jar:/usr/share/apache-tomcat-6.0.30/webapps/mondrian/WEB-INF/lib/commons-collections-3.1.jar:/usr/share/apache-tomcat-6.0.30/webapps/mondrian/WEB-INF/lib/eigenbase-xom.jar:/usr/share/apache-tomcat-6.0.30/webapps/mondrian/WEB-INF/lib/eigenbase-resgen.jar:/usr/share/apache-tomcat-6.0.30/webapps/mondrian/WEB-INF/lib/eigenbase-properties.jar:/usr/share/apache-tomcat-6.0.30/webapps/mondrian/WEB-INF/lib/mysql-connector-java-5.1.14-bin.jar" mondrian.test.loader.MondrianFoodMartLoader 
-verbose -tables -data -indexes -jdbcDrivers=com.mysql.jdbc.Driver 
-inputFile=/opt/mondrian-3.2.0.13661/demo/FoodMartCreateData.sql
-outputJdbcURL="jdbc:mysql://localhost/foodmart?user=foodmart&password=foodmart"

In the above, I have used the full directory paths for everything. So you can run the above from any directory. It also allows you to see exactly where everything is coming from.

My Tomcat installation is located at /usr/share/apache-tomcat-6.0.30, so if yours is elsewhere, you'll need to update this above.

Similarly, I have placed mysql-connector-java-5.1.14-bin.jar in mondrain/WEB-INF/lib. If you already have this elsewhere or are using a different version of connector j, update accordingly.

The Pentaho/Mondrian docs do not mention using commons-collections-3.1.jar, but I needed to use this to get the data to load.

Now that we have loaded all of the require jars and loaded the sample data, we need to create a data source, and edit some files.

7. Create a Data Source:

Create a Data Source, we'll call it DsMySQL.

Open /usr/share/apache-tomcat-6.0.30/webapps/mondrian/WEB-INF/datasurce.xml and edit to look like below.


 
   Provider=Mondrian;DataSource=DsMySQL;
   FoodMart Data Warehouse
   http://localhost:8080/mondrian/xmla
   

Provider=mondrian;Jdbc=jdbc:mysql://localhost/foodmart;JdbcUser=foodmart;JdbcPassword=foodmart;JdbcDrivers=com.mysql.jdbc.Driver;
  Mondrian
  MDP
  Unauthenticated
   
    
     /WEB-INF/queries/FoodMart.xml

8. Edit Mondrian web.xml.

Replace the two instances of @mondrian.webapp.connectString@ with the following:

Provider=mondrian;Jdbc=jdbc:mysql://localhost/foodmart?user=foodmart&password=foodmart;Catalog=/WEB-INF/queries/FoodMart.xml;JdbcDrivers=com.mysql.jdbc.Driver;

Original web.xml entries:


    connectString@mondrian.webapp.connectString@

  
    MDXQueryServlet
    mondrian.web.servlet.MdxQueryServlet
    
      connectString@mondrian.webapp.connectString@

Web.xml after editing:


    connectStringProvider=mondrian;Jdbc=jdbc:mysql://localhost/foodmart?user=foodmart&password=foodmart;Catalog=/WEB-INF/queries/FoodMart.xml;JdbcDrivers=com.mysql.jdbc.Driver;
  
    MDXQueryServlet
    mondrian.web.servlet.MdxQueryServlet
    
      connectStringProvider=mondrian;Jdbc=jdbc:mysql://localhost/foodmart?user=foodmart&password=foodmart;Catalog=/WEB-INF/queries/FoodMart.xml;JdbcDrivers=com.mysql.jdbc.Driver;

9. Edit Queries

Under /usr/share/apache-tomcat-6.0.30/webapps/mondrian/WEB-INF/queries, edit the following:

fourhier.jsp
mondrian.jsp
colors.jsp
arrows.jsp

In each case, replace this:

with this...

For testrole.jsp, replace this:

with this...

For xmla.jsp, replace this:

with this...(using the Data Source, DsMySQL, we created in step 7 above):

10. Edit Catalina.sh to force use of Axis for SOAP:

/usr/share/apache-tomcat-6.0.30/bin/Catalina.sh

Add the following:

JAVA_OPTS="-Djavax.xml.soap.MessageFactory=org.apache.axis.soap.MessageFactoryImpl -
Djavax.xml.soap.SOAPConnectionFactory=org.apache.axis.soap.SOAPConnectionFactoryImpl -Djavax.xml.soap.SOAPFactory=org.apache.axis.soap.SOAPFactoryImpl"

11. Restart Tomcat to Reload Edited Files.

[root@srv6 ~]# service tomcat restart
Using CATALINA_BASE:   /usr/share/apache-tomcat-6.0.30
Using CATALINA_HOME:   /usr/share/apache-tomcat-6.0.30
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-6.0.30/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_23
Using CLASSPATH:       /usr/share/apache-tomcat-6.0.30/bin/bootstrap.jar
Using CATALINA_BASE:   /usr/share/apache-tomcat-6.0.30
Using CATALINA_HOME:   /usr/share/apache-tomcat-6.0.30
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-6.0.30/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_23
Using CLASSPATH:       /usr/share/apache-tomcat-6.0.30/bin/bootstrap.jar

That should do it :)

Navigate to http://YourIP:8080/modrian or http://YourDomain.com:8080/mondrian and verify that all samples are working correctly.

Notes:

Mondrian Installation Docs:
http://mondrian.pentaho.com/documentation/installation.php

Forcing Mondrian to use axis (SOAP) and Xalan libraries for JPivot by Sherman Wood;
http://lists.pentaho.org/pipermail/mondrian/2009-January/001550.html
http://lists.pentaho.org/pipermail/mondrian/2009-January/001553.html

I did not use Xalan in the above post.

A great step-by-step guide to trouble-shooting each sample app from Feris Thia:
http://pentaho-en.phi-integration.com/mondrian/configuring-mondrian-sample

Install Tomcat 7 on CentOS / RHEL

2011-02-01T01:36:00.000-08:00

This post will cover installing and basic configuration of Tomcat 7 on CentOS 5.x.

The procedure can be used for Fedora and RHEL as well.

Tomcat 7 implements the JavaServer Pages 2.2 and Servlet 3.0 specifications and a number of new features. The Manager application also has a new look with finer-grain roles and access than 6.x

In this post, we'll install the required JDK, Tomcat, configure Tomcat as a service, create a start/stop/restart script, and (optionally) configure Tomcat to run under a non-root user.

PLEASE NOTE: This post covers installation of Tomcat 7 along with JDK 6. For installation of Tomcat 7 with JDK 7 (recommended), please see my updated post here:

http://www.davidghedini.com/pg/entry/install_tomcat_7_on_centos

For this installation, we'll use Tomcat 7.0.19, the current stable release of Tomcat 7. This post began with the first Tomcat 7 release and I have tried to keep it updated to keep things as "copy and paste" as possible.

I've also updated the post for JDK 6, Update 26.

To begin, we'll need to install the Java Development Kit (JDK) 1.6

JDK 1.6 is the minimum JDK version for Tomcat 7.

If you do have the JDK installed, you can skip to: Step 2: Download and Unpack Tomcat 7.0.19:

Step 1: Install JDK 1.6

You can download the JDK here: http://www.oracle.com/technetwork/java/javase/downloads/index.html

We'll install the latest JDK, which is JDK 6 Update 26. The JDK is specific to 32 and 64 bit versions.

My CentOS box is 64 bit, so I'll need: jdk-6u26-linux-x64.bin

If you are on 32 bit, you'll need: jdk-6u26-linux-i586.bin

Download the appropriate JDK and save it to a directory. I'm saving it to /root.

Move (mv) or copy (cp) the file to the /opt directory:

[root@srv6 ~]# mv jdk-6u26-linux-x64.bin /opt/jdk-6u26-linux-x64.bin

Create a new directory /usr/java.

[root@srv6 ~]# mkdir /usr/java

Change to the /usr/java directory we created and install the JDK using 'sh /opt/jdk-6u26-linux-x64.bin'

[root@srv6 ~]# cd /usr/java
[root@srv6 java]# sh /opt/jdk-6u26-linux-x64.bin

Set the JAVA_HOME path. This is where we installed our JDK above.

To set it for your current session, you can issue the following from the CLI:

[root@srv6 java]# JAVA_HOME=/usr/java/jdk1.6.0_26
[root@srv6 java]# export JAVA_HOME
[root@srv6 java]# PATH=$JAVA_HOME/bin:$PATH
[root@srv6 java]# export PATH

To set the JAVA_HOME permanently, we add below to either the ~/.bashrc or ~/.bash_profile of the user (in this case, root).

We can also add it /etc/profile and then source it to give to all users.

JAVA_HOME=/usr/java/jdk1.6.0_26
export JAVA_HOME
PATH=$JAVA_HOME/bin:$PATH
export PATH

Once you have added the above to ~/.bash_profile or ~/.bashrc, you should log out, then log back in and check that the JAVA_HOME is set correctly.

[root@srv6 ~]#  echo $JAVA_HOME
/usr/java/jdk1.6.0_26

Step 2: Download and Unpack Tomcat 7.0.19

Download apache-tomcat-7.0.19.tar.gz here

Alternatively, you can download using wget.

[root@srv6 ~]#  wget http://apache.mivzakim.net/tomcat/tomcat-7/v7.0.19/bin/apache-tomcat-7.0.19.tar.gz

Save the file to a directory. I'm saving it to /root/apache-tomcat-7.0.19.tar.gz

Before proceeding, you should verify the MD5 Checksum for your Tomcat download (or any other download).

Since we saved the Tomcat download to /root/apache-tomcat-7.0.19.tar.gz, we'll go to the /root directory and use the md5sum command.

[root@srv6 ~]# md5sum apache-tomcat-7.0.19.tar.gz
5a5e9bc742714d1b7210d9f68764fd8e *apache-tomcat-7.0.19.zip

Compare the output above to the MD5 Checksum provided by here the Apache Tomcat MD5 page and insure that they match exactly.

Now, move (mv) or copy (cp) the file to the /usr/share directory:

[root@srv6 ~]# mv apache-tomcat-7.0.19.tar.gz /usr/share/apache-tomcat-7.0.19.tar.gz

Change to the /usr/share directory and unpack the file using tar -xzf:

[root@srv6 ~]# cd /usr/share
[root@sv2 srv6 ]# tar -xzf apache-tomcat-7.0.19.tar.gz

This will create the directory /usr/share/apache-tomcat-7.0.19

Step 3: Configure Tomcat to Run as a Service.

We will now see how to run Tomcat as a service and create a simple Start/Stop/Restart script, as well as to start Tomcat at boot.

Change to the /etc/init.d directory and create a script called 'tomcat' as shown below.

[root@srv6 share]# cd /etc/init.d
[root@srv6 init.d]# vi tomcat

#!/bin/bash
# description: Tomcat Start Stop Restart
# processname: tomcat
# chkconfig: 234 20 80
JAVA_HOME=/usr/java/jdk1.6.0_26
export JAVA_HOME
PATH=$JAVA_HOME/bin:$PATH
export PATH
CATALINA_HOME=/usr/share/apache-tomcat-7.0.19


case $1 in
start)
sh $CATALINA_HOME/bin/startup.sh
;; 
stop)   
sh $CATALINA_HOME/bin/shutdown.sh
;; 
restart)
sh $CATALINA_HOME/bin/shutdown.sh
sh $CATALINA_HOME/bin/startup.sh
;; 
esac    
exit 0

The above script is simple and contains all of the basic elements you will need to get going.

As you can see, we are simply calling the startup.sh and shutdown.sh scripts located in the Tomcat bin directory (/usr/share/apache-tomcat-7.0.19/bin).

You can adjust your script according to your needs and, in subsequent posts, we'll look at additional examples.

CATALINA_HOME is the Tomcat home directory (/usr/share/apache-tomcat-7.0.19)

Now, set the permissions for your script to make it executable:

[root@srv6 init.d]# chmod 755 tomcat

We now use the chkconfig utility to have Tomcat start at boot time. In my script above, I am using chkconfig: 234 20 80. 2445 are the run levels and 20 and 80 are the stop and start priorities respectively. You can adjust as needed.

[root@srv6 init.d]# chkconfig --add tomcat
[root@srv6 init.d]# chkconfig --level 234 tomcat on

Verify it:

[root@srv6 init.d]# chkconfig --list tomcat
tomcat          0:off   1:off   2:on    3:on    4:on    5:off   6:off

Now, let's test our script.

Start Tomcat:

[root@srv6 ~]# service tomcat start
Using CATALINA_BASE:   /usr/share/apache-tomcat-7.0.19
Using CATALINA_HOME:   /usr/share/apache-tomcat-7.0.19
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-7.0.19/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_26
Using CLASSPATH:       /usr/share/apache-tomcat-7.0.19/bin/bootstrap.jar:/usr/share/apache-tomcat-7.0.19/bin/tomcat-juli.jar

Stop Tomcat:

[root@srv6 ~]# service tomcat stop
Using CATALINA_BASE:   /usr/share/apache-tomcat-7.0.19
Using CATALINA_HOME:   /usr/share/apache-tomcat-7.0.19
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-7.0.19/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_26
Using CLASSPATH:       /usr/share/apache-tomcat-7.0.19/bin/bootstrap.jar:/usr/share/apache-tomcat-7.0.19/bin/tomcat-juli.jar

Restarting Tomcat (Must be started first):

[root@srv6 ~]# service tomcat restart
Using CATALINA_BASE:   /usr/share/apache-tomcat-7.0.19
Using CATALINA_HOME:   /usr/share/apache-tomcat-7.0.19
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-7.0.19/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_26
Using CLASSPATH:       /usr/share/apache-tomcat-7.0.19/bin/bootstrap.jar:/usr/share/apache-tomcat-7.0.19/bin/tomcat-juli.jar
Using CATALINA_BASE:   /usr/share/apache-tomcat-7.0.19
Using CATALINA_HOME:   /usr/share/apache-tomcat-7.0.19
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-7.0.19/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_26
Using CLASSPATH:       /usr/share/apache-tomcat-7.0.19/bin/bootstrap.jar:/usr/share/apache-tomcat-7.0.19/bin/tomcat-juli.jar

We should review the Catalina.out log located at /usr/share/apache-tomcat-7.0.19/logs/catalina.out and check for any errors.

[root@srv6 init.d]# more /usr/share/apache-tomcat-7.0.19/logs/catalina.out

We can now access the swanky new Tomcat Manager page at:

http://yourdomain.com:8080 or http://yourIPaddress:8080 and we should see the Tomcat home page.

Step 4: Configuring Tomcat Manager Access.

Tomcat 7 contains a number of changes that offer finer-grain roles.

For security reasons, no users or passwords are created for the Tomcat manager roles by default. In a production deployment, it is always best to remove the Manager application.

To set roles, user name(s) and password(s), we need to configure the tomcat-users.xml file located at $CATALINA_HOME/conf/tomcat-users.xml.

In the case of our installation, $CATALINA_HOME is located at /usr/share/apache-tomcat-7.0.19.

By default the Tomcat 7 tomcat-users.xml file will look as below.

<!--
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->
<tomcat-users>
<!--
  NOTE:  By default, no user is included in the "manager-gui" role required
  to operate the "/manager/html" web application.  If you wish to use this app,
  you must define such a user - the username and password are arbitrary.
-->
<!--
  NOTE:  The sample user and role entries below are wrapped in a comment
  and thus are ignored when reading this file. Do not forget to remove
  <!.. ..> that surrounds them.
-->
<!--
  <role rolename="tomcat"/>
  <role rolename="role1"/>
  <user username="tomcat" password="tomcat" roles="tomcat"/>
  <user username="both" password="tomcat" roles="tomcat,role1"/>
  <user username="role1" password="tomcat" roles="role1"/>
-->
</tomcat-users>

Note that while examples are provided, the elements between the <tomcat-users> and </tomcat-users> tags have been commented-out.

New roles for Tomcat 7 offer finer-grained access.

The following roles are available:

manager-gui
manager-status
manager-jmx
manager-script
admin-gu
admin-script.

We can enable access for the manager-gui role, for example as below:

<tomcat-users>
<role rolename="manager-gui">
<user username="tomcat" password="secret" roles="manager-gui">
</user>
</role></tomcat-users>

Caution should be exercised in granting multiple roles so as not to under-mind security.

Step 5 (Optional): How to Run Tomcat using Minimally Privileged (non-root) User.

In our Tomcat configuration above, we are running Tomcat as Root.

For security reasons, it is always best to run services with the only those privileges that are necessary.

There are some who make a strong case that this is not required, but it's always best to err on the side of caution.

To run Tomcat as non-root user, we need to do the following:

1. Create the group 'tomcat':

[root@srv6 ~]# groupadd tomcat

2. Create the user 'tomcat' and add this user to the tomcat group we created above.

[root@srv6 ~]# useradd -s /bin/bash -g tomcat tomcat

The above will create a home directory for the user tomcat in the default user home as /home/tomcat

If we want the home directory to be elsewhere, we simply specify so using the -d switch.

[root@srv6 ~]# useradd -g tomcat -d /usr/share/apache-tomcat-7.0.19/tomcat tomcat

The above will create the user tomcat's home directory as /usr/share/apache-tomcat-7.0.19/tomcat

3. Change ownership of the tomcat files to the user tomcat we created above:

[root@srv6 ~]# chown -Rf tomcat.tomcat /usr/share/apache-tomcat-7.0.19/

Note: it is possible to enhance our security still further by making certain files and directories read-only. This will not be covered in this post and care should be used when setting such permissions.

4. Adjust the start/stop service script we created above. In our new script, we need to su to the user tomcat:

#!/bin/bash
# description: Tomcat Start Stop Restart
# processname: tomcat
# chkconfig: 234 20 80
JAVA_HOME=/usr/java/jdk1.6.0_26
export JAVA_HOME
PATH=$JAVA_HOME/bin:$PATH
export PATH
TOMCAT_HOME=/usr/share/apache-tomcat-7.0.19/bin


case $1 in
start)
/bin/su tomcat $TOMCAT_HOME/startup.sh
;; 
stop)   
/bin/su tomcat $TOMCAT_HOME/shutdown.sh
;; 
restart)
/bin/su tomcat $TOMCAT_HOME/shutdown.sh
/bin/su tomcat $TOMCAT_HOME/startup.sh
;; 
esac    
exit 0

Step 6 (Optional): How to Run Tomcat on Port 80 as Non-Root User.

Note: the following applies when you are running Tomcat in "stand alone" mode with Tomcat running under the minimally privileged user Tomcat we created in the previous step.

To run services below port 1024 as a user other than root, you can add the following to your IP tables:

[root@srv6 ~]# iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080  
[root@srv6 ~]# iptables -t nat -A PREROUTING -p udp -m udp --dport 80 -j REDIRECT --to-ports 8080

Be sure to save and restart your iptables for the above change to take affect.

Related Posts:
Tomcat Oracle JDBC Connection
Tomcat Manager Password
Tomcat Custom 404 Page
Install Tomcat 6 on CentOS

Learn More About Apache Tomcat 7

Apache Tomcat Foundation
Tomcat 7

Tomcat Oracle JDBC Connection using JNDI Resource

2010-12-26T06:37:00.000-08:00

This post will cover connecting your Tomcat web application to Oracle via JDBC using Tomcat's JNDI emulation ability.

We'll be creating this example using Tomcat 6.0.29 on CentOS 5.5

In our example, we'll create a connection for an application in the Tomcat/webapps/ROOT directory.

We'll also do the same for an application in a directory other than ROOT (e.g. Tomcat/webapps/myapp).

In our examples below, I have installed Tomcat at /usr/share/apache-tomcat-6.0.29.

Adjust this to your Tomcat installation as required.

First, let's create a simple test table in Oracle.

CREATE TABLE  DEMO_CUSTOMERS 
   (    CUSTOMER_ID NUMBER, 
    CUST_FIRST_NAME VARCHAR2(20), 
    CUST_LAST_NAME VARCHAR2(20) 
    
   )

Now, let's populate it with some data.

INSERT INTO DEMO_CUSTOMERS VALUES (1, 'John ', 'Dulles');
INSERT INTO DEMO_CUSTOMERS VALUES (2, 'William ', 'Hartsfield');
INSERT INTO DEMO_CUSTOMERS VALUES (3, 'Edward', 'Logan');
INSERT INTO DEMO_CUSTOMERS VALUES (4, 'Edward "Butch"', 'OHAare');
INSERT INTO DEMO_CUSTOMERS VALUES (5, 'Fiorello', 'Lambert');
INSERT INTO DEMO_CUSTOMERS VALUES (6, 'Albert', 'Hartsfield');
INSERT INTO DEMO_CUSTOMERS VALUES (7, 'Eugene', 'Bradley');

1. Download the required drivers

You will need to download the required Oracle JDBC drivers from the OTN

Both ojdbc6.jar and ojdbc14.jar will work for this example.

Additionally, since I will be using JSP Standard Tag Library (or JSTL), I will also need to download standard.jar and jstl.jar, which you can download here.

2. Move the drivers above to: /usr/share/apache-tomcat-6.0.29/lib

[root@sv2 ~]# mv ojdbc14.jar /usr/share/apache-tomcat-6.0.29/lib/ojdbc14.jar
[root@sv2 ~]# mv standard.jar /usr/share/apache-tomcat-6.0.29/lib/standard.jar
[root@sv2 ~]# mv jstl.jar /usr/share/apache-tomcat-6.0.29/lib/jstl.jar

By placing the drivers in the TOMCAT_HOME/lib directory, we are making them available to all applications.

3. Create the JDBC JNDI resource for our default context

Since we are using the ROOT directory, we will be using /usr/share/apache-tomcat-6.0.29/conf/context.xml.

Add the following:

<Resource name="jdbc/oradb"
          auth="Container"
          type="javax.sql.DataSource"
          driverClassName="oracle.jdbc.OracleDriver"
          url="jdbc:oracle:thin:@host:1521:sid"
          username="username"
          password="password"
          maxActive="20"
          maxIdle="30"
          maxWait="-1"
/>

Replace the url, username, and password above with your own.

I've used 'oradb' as my resource name. You can use whatever you like.

For an explanation of maxActive, maxIdle, and maxWait, and other attributes, please see the Context Configuration section of the Tomcat JNDI Datasource HOW-TO

4. Add a Resource-Ref to our web.xml file.

Again, we are using the ROOT directory so we'll add our resource-ref to /usr/share/apache-tomcat-6.0.29/webapps/ROOT/WEB-INF/web.xml


jdbc/oradb
javax.sql.DataSource
Container

5. Create a JSP page to test our set up.

I'll call the file mytest.jsp and place it into the ROOT directory (/usr/share/apache-tomcat-6.0.29/webapps/ROOT)

<%@ taglib uri="http://java.sun.com/jsp/jstl/sql" prefix="sql" %>
<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>

  <html>
  <head>

    
       select * from DEMO_CUSTOMERS
    

  </head>
  <body>
    <h1>Testing JDBC JINDI Oracle</h1>
    <table width='500' border='1'>
      <tr>
        <th align='left'>Customer Id</th>
        <th align='left'>Customer First Name</th>
        <th align='left'>Customer Last Name</th>
      </tr>
      <c:forEach var="democusts" items="${democusts.rows}">
        <tr>
           <td> ${democusts.CUSTOMER_ID}</td>
           <td> ${democusts.CUST_FIRST_NAME} </td>
           <td> ${democusts.CUST_LAST_NAME} </td>
       </tr>
      </c:forEach>
    </table>
  </body>
  </html>

Now start (or restart) Tomcat to allow it to read the changes to our configuration files

[root@sv2 ~]# service tomcat start
Using CATALINA_BASE:   /usr/share/apache-tomcat-6.0.29
Using CATALINA_HOME:   /usr/share/apache-tomcat-6.0.29
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-6.0.29/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_23
Using CLASSPATH:       /usr/share/apache-tomcat-6.0.29/bin/bootstrap.jar

We can now navigate to http://YourDomain.com:8080/mytest.jsp and we should see the following:

6. Locations when using directory outside of ROOT.

If you web application does not live in the ROOT directory, you can apply the above to using the following locations within your application.

For an application called "MyApp", for example, you could use the following locations.

JDBC JNDI Resource: Webapps>MyApp>META-INF/context.xml

Resource-Ref: Webapps>MyApp>WEB-INF/web.xml

Drivers: Webapps>MyApp>WEB-INF/lib/{ojdbc14.jar, standard.jar, jstl.jar}

If any of the directories or files above do not exist, you will need to create them.

Again, you can leave the drivers under Tomcat/lib if you want them to be available to all applications.

For more information, see Apache Tomcat JNDI Datasource HOW-TO

Related Posts:
Install Tomcat 6 on CentOS
Tomcat Manager Password
Tomcat Custom 404 Page

Install GlassFish 3 on CentOS

2010-12-23T16:46:00.000-08:00

This post will cover installing GlassFish 3.0.1 on CentOS 5.x.

We'll also see how to run GlassFish as a service, how to access the Admin Console, and how to run GlassFish under a minimally privileged user.

GlassFish 3.0.1 is available two editions.

GlassFish Server Open Source Edition 3.0.1 (free) and Oracle GlassFish Server 3.0.1 (supported and requires paid subscription).

I installed both using the same process below on CentOS 5.5.

This post is intended to get a basic installation of GlassFish 3.0.1 up and running. Please consult the documentation.

If you do not already have the Java Development Kit (JDK) installed on your machine, you will need to download and install the required JDK for your platform.

If you do have the JDK installed, you can skip to: Step 2: Download and Install the GlassFish 3.0.1 Server:

Step 1: Install the JDK

You can download the JDK here: http://www.oracle.com/technetwork/java/javase/downloads/index.html

I'm using the latest, which is JDK 6, update 24. The JDK is specific to 32 and 64 bit versions.

My CentOS box is 64 bit, so I'll need: jdk-6u24-linux-x64.bin.

If you are on 32 bit, you'll need: jdk-6u24-linux-i586.bin

Download the appropriate JDK and save it to a directory. I'm saving it to /root.

Move (mv) or copy (cp) the file to the /opt directory:

[root@sv2 ~]# mv jdk-6u24-linux-x64.bin /opt/jdk-6u24-linux-x64.bin

Create the directory /usr/java.

[root@sv2 ~]# mkdir /usr/java

Change to the /usr/java directory we created and install the JDK using 'sh /opt/jdk-6u24-linux-x64.bin'

[root@sv2 ~]# cd /usr/java
[root@sv2 java]# sh /opt/jdk-6u24-linux-x64.bin

Set the JAVA_HOME path. This is where we installed the JDK above.

To do this for your current session, you can issue the following:

[root@sv2 java]# JAVA_HOME=/usr/java/jdk1.6.0_24
[root@sv2 java]# export JAVA_HOME
[root@sv2 java]# PATH=$JAVA_HOME/bin:$PATH
[root@sv2 java]# export PATH

To set the JAVA_HOME for users, we add this to the user ~/.bashrc or ~/.bash_profile of the user. We can also add it /etc/profile and then source it to give to all users.

JAVA_HOME=/usr/java/jdk1.6.0_24 
export JAVA_HOME 
PATH=$JAVA_HOME/bin:$PATH 
export PATH

Once you have added the above to ~/.bash_profile or ~/.bashrc, you should log out, then log back in and check that the JAVA_HOME is set correctly.

[root@sv2 ~]#  echo $JAVA_HOME
/usr/java/jdk1.6.0_24

Step 2: Download and Install the GlassFish 3.0.1 Server:

You can download both the GlassFish Server Open Source Edition 3.0.1 and Oracle GlassFish Server 3.0.1 at http://glassfish.java.net/

Once you have downloaded the desired file, move (mv) or copy (cp) the file to /usr/share/glassfish-3.0.1.zip (or /usr/share/ogs-3.0.1.zip for Oracle GlassFish).

[root@sv2 ~]# mv glassfish-3.0.1.zip /usr/share/glassfish-3.0.1.zip

Change to the /usr/share directory and unzip the file:

[root@sv2 ~]# cd /usr/share
[root@sv2 share]# unzip -q glassfish-3.0.1.zip

The unzip will create the following directory: /usr/share/glassfishv3

Note: Both GlassFish editions will create the same directory when unzipped: glassfishv3

At this point, we should be able to start and stop GlassFish using:

/usr/share/glassfishv3/glassfish/bin/asadmin start-domain domain1

and

/usr/share/glassfishv3/glassfish/bin/asadmin stop-domain domain1

Start GlassFish:

[root@sv2 share]# /usr/share/glassfishv3/glassfish/bin/asadmin start-domain domain1
Waiting for DAS to start ...
Started domain: domain1
Domain location: /usr/share/glassfishv3/glassfish/domains/domain1
Log file: /usr/share/glassfishv3/glassfish/domains/domain1/logs/server.log
Admin port for the domain: 4848
Command start-domain executed successfully.
[root@sv2 share]#

Stop GlassFish:

[root@sv2 share]# /usr/share/glassfishv3/glassfish/bin/asadmin stop-domain domain1
Waiting for the domain to stop ....
Command stop-domain executed successfully.
[root@sv2 share]#

Note: If you did not set the JAVA_HOME and PATH for the user you are logged in as, or for your current session, when you attempt to start the GlassFish server it will complain it cannot find Java with the following:

error: /usr/share/glassfishv3/glassfish/bin/asadmin: line 19: exec: java: not found

Step 3: Running GlassFish as a Service.

To run GlassFish as a service and enable start up at boot, we'll now create a Start/Stop/Restart script.

We'll create the script as /etc/init.d/glassfish, make the script executable, and then add our new glassfish service to chkconfig.

Create our glassfish script:

[root@sv2 ~]# cd /etc/init.d
[root@sv2 init.d]# vi glassfish

#!/bin/bash
# description: Glassfish Start Stop Restart
# processname: glassfish
# chkconfig: 234 20 80
JAVA_HOME=/usr/java/jdk1.6.0_24
export JAVA_HOME
PATH=$JAVA_HOME/bin:$PATH
export PATH
GLASSFISH_HOME=/usr/share/glassfishv3/glassfish

case $1 in
start)
sh $GLASSFISH_HOME/bin/asadmin start-domain domain1
;;
stop)
sh $GLASSFISH_HOME/bin/asadmin stop-domain domain1
;;
restart)
sh $GLASSFISH_HOME/bin/asadmin stop-domain domain1
sh $GLASSFISH_HOME/bin/asadmin start-domain domain1
;;
esac
exit 0

If you do not set the JAVA_HOME and PATH in the GlassFish script, when you attempt to start the GlassFish server it will complain it cannot find Java with the following:

error: /usr/share/glassfishv3/glassfish/bin/asadmin: line 19: exec: java: not found

Now, make the script executable and add it to our chkconfig so it starts at boot.

[root@sv2 init.d]# chmod 755 glassfish
[root@sv2 init.d]# chkconfig --add glassfish
[root@sv2 init.d]# chkconfig --level 234 glassfish on

We should now be able to Start, Stop, and Restart GlassFish as a service.

Start GlassFish:

[root@sv2 init.d]# service glassfish start
Waiting for DAS to start .....
Started domain: domain1
Domain location: /usr/share/glassfishv3/glassfish/domains/domain1
Log file: /usr/share/glassfishv3/glassfish/domains/domain1/logs/server.log
Admin port for the domain: 4848
Command start-domain executed successfully.

Stop GlassFish:

[root@sv2 init.d]# service glassfish stop
Waiting for the domain to stop ....
Command stop-domain executed successfully.

Step 4: Access GlassFish Admin Console.

You should now be able to access the GlassFish Admin Console at:

http://yourdomain.com:4848 or http://yourip:4848

On accessing the GlassFish Admin Console for the first time, you will find that no user name or password is required.

Previous to 3.0.1, a default password 'adminadmin' was used.

You can set (or change) the admin password within the GlassFish Admin console.

1. Click "Enterprise Server" on the tree.

2. Click the Administrator Password tab.

3. Enter and confirm your password and click Save.

The first password save will create a file,.asadminpass, in the home directory of the user you are running the service under.

Alternatively, you can set the admin password via the CLI using.

[root@sv2 bin]# $GLASSFISH_HOME/bin/asadmin change-admin-password
Enter admin user name [default: admin]>
Enter admin password>
Enter new admin password>
Enter new admin password again>

Command change-admin-password executed successfully.
[root@sv2 bin]#

Note: to make using the CLI easier, I've added the following lines to my ~/.bashrc (or ~/.bash_profile):

GLASSFISH_HOME=/usr/share/glassfishv3/glassfish
export GLASSFISH_HOME

So your ~/.bashrc or ~/.bash_profile will look like this:

JAVA_HOME=/usr/java/jdk1.6.0_24
export JAVA_HOME
PATH=$JAVA_HOME/bin:$PATH
export PATH
GLASSFISH_HOME=/usr/share/glassfishv3/glassfish
export GLASSFISH_HOME

As you can see above, I can now use $GLASSFISH_HOME rather than the full path of /usr/share/glassfishv3/glassfish.

Step 5: Running GlassFish with Minimally Privileged (non-root) User.

Since I am installing this on my development machine, I am running GlassFish as root above.

In production, you will want to run GlassFish as a non-root user with minimal privileges.

To do this, we can need to the following.

1. Create the user, glassfish, who will own the files.

Create the new group, glassfish, and add the user glassfish to the group:

[root@sv2 ~]# groupadd glassfish
[root@sv2 ~]# useradd -s /bin/bash -g glassfish glassfish

2. Change ownership of the GlassFish files to the user glassfish we created.

We'll change ownership of the files under /usr/share/glassfishv3 from root to the user glassfish we created above:

[root@sv2 ~]# chown -Rf glassfish.glassfish /usr/share/glassfishv3/

3. Update our glassfish script.

Finally, we update the glassfish start/stop/restart script we created above so we su to user glassfish:

#!bin/bash
# description: Glassfish Start Stop Restart
# processname: glassfish
# chkconfig: 234 20 80
JAVA_HOME=/usr/java/jdk1.6.0_24
export JAVA_HOME
PATH=$JAVA_HOME/bin:$PATH
export PATH
GLASSFISH_HOME=/usr/share/glassfishv3/glassfish
GLASSFISH_USER=glassfish

case $1 in
start)
su $GLASSFISH_USER -c "$GLASSFISH_HOME/bin/asadmin start-domain domain1"
;;
stop)
su $GLASSFISH_USER -c "$GLASSFISH_HOME/bin/asadmin stop-domain domain1"
;;
restart)
su $GLASSFISH_USER -c "$GLASSFISH_HOME/bin/asadmin stop-domain domain1"
su $GLASSFISH_USER -c "$GLASSFISH_HOME/bin/asadmin start-domain domain1"
;;
esac
exit 0

Step 6: Running GlassFish on Port 80 as Non-Root User.

To run services below port 1024 as user other than root, you will need to use port forwarding.

You can do this by adding the following to your IP tables:

[root@sv2 ~]# iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
[root@sv2 ~]# iptables -t nat -A PREROUTING -p udp -m udp --dport 80 -j REDIRECT --to-ports 8080

Note: GlassFish 3.1 has now been released. For GlassFish 3.1 installation, you can view my tutorial here:
http://www.davidghedini.com/pg/entry/install_glassfish_3_1_on
It is basically the same procedure as GlassFish 3.0.1, with some minor changes.

GlassFish Quick Start Guide

http://glassfish.java.net/

Oracle GlassFish Docs

Tomcat Custom 404 Page

2010-10-30T16:29:00.000-07:00

This post will cover creating a custom 404 Error page for Tomcat.

By default, if a requested page does not exist, a 404 Error is raised and the user is served Tomcat's default 404 error page as below:

Above, I requested a page called 'david' which does not exist.

To make your 404 page a bit more presentable, provide the user with a link back into your site, as well as hide the Tomcat version in use, you can easily add a custom 404 error page.

Start by creating the page you wish to use. In my case, I am creating a page called 'NotFound.jsp'

Add the 404 page you crated to your site directory.

Now, in your $CATALINA_HOME/conf directory, edit your web.xml file.

Add the following entry just beneath the welcome-file-list entry as shown below:

<welcome-file-list>
        <welcome-file>index.html</welcome-file>
        <welcome-file>index.htm</welcome-file>
        <welcome-file>index.jsp</welcome-file>
    </welcome-file-list>

   <error-page>
       <error-code>404</error-code>
         <location>/NotFound.jsp</location>
   </error-page>

Now, when someone goes to a page that does not exist, they get the custom 404 page we created.

for example: http://www.davidghedini.com/YadaYadaYada.jsp

SEO Disclaimer: I've called my page NotFound.jsp page and have added a meta-tag:

meta content="noindex" name="robots">

I did this as it (supposedly), the tag will stop search engined from indexing my 404 page. I'm not an SEO guy so whether this is necessary (or even a good idea), I don't know. You could, of course, place your 404 page within a sub directory (e.g. '404') and adjust the location in your web.xml from /404/NotFound.jsp to /NotFound.jsp. You could then add a robots.txt file to prevent crawling of the directory.

Related Posts:
Install Tomcat 6 on CentOS
Tomcat Oracle JDBC Connection
Tomcat Manager Password

Install PostgreSQL 9 on CentOS

2010-10-30T13:58:00.000-07:00

This post will cover installing PostgreSQL 9 on CentOS.


PLEASE NOTE: I have created an updated and expanded installation guide covering PostgreSQL 9.1 here:

http://www.davidghedini.com/pg/entry/install_postgresql_9_on_centos

PLEASE USE THE ABOVE GUIDE.
PostgreSQL 9 is the first major release from PostgreSQL in some time and the directory structure has changed. 

If you are using Webmin, we will also show how to configure Webmin to manage PostgreSQL 9.

PLEASE NOTE: If you are looking to install PostgreSQL 9 on cPanel, please see my step-by-step guide here: 
http://www.davidghedini.com/pg/entry/installing_postgresql_9_on_cpanel:

We'll use the simplest method to install, which is the postrgres repo rpms.

Begin by locating the appropriate one here:

http://yum.pgrpms.org/reporpms/repoview/pgdg-centos.html

There is a 9.1.1 Alpha version available, but I am going to install 9.0.2

For CentOS I will need:

http://yum.pgrpms.org/reporpms/9.0/pgdg-centos-9.0-2.noarch.rpm

So, using wget:

wget http://yum.pgrpms.org/reporpms/9.0/pgdg-centos-9.0-2.noarch.rpm

[root@server1 ~]# wget http://yum.pgrpms.org/reporpms/9.0/pgdg-centos-9.0-2.noarch.rpm
--2010-10-29 15:38:15--  http://yum.pgrpms.org/reporpms/9.0/pgdg-centos-9.0-2.noarch.rpm
Resolving yum.pgrpms.org... 77.79.103.58
Connecting to yum.pgrpms.org|77.79.103.58|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 4623 (4.5K) [application/x-rpm]
Saving to: `pgdg-centos-9.0-2.noarch.rpm'

100%[======================================>] 4,623       --.-K/s   in 0s

2010-10-29 15:38:15 (259 MB/s) - `pgdg-centos-9.0-2.noarch.rpm' saved [4623/4623]
Now install the repo....[root@server1 ~]# rpm -i pgdg-centos-9.0-2.noarch.rpm
We now need to edit the CentOS-Base.repo to exclude postgre.To do, so we simply edit CentOS-Base.repo and add 'exclude=postgresql*'  to the [base] and [updates] sections:[root@server1 ~]# cd /etc/yum.repos.d
[root@server1 yum.repos.d]# vi CentOS-Base.repo

[base]
name=CentOS-$releasever - Base
mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os
#baseurl=http://mirror.centos.org/centos/$releasever/os/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5
exclude=postgresql*

#released updates
[updates]
name=CentOS-$releasever - Updates
mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=updates
#baseurl=http://mirror.centos.org/centos/$releasever/updates/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5
exclude=postgresql* 
Now, let's use 'yum list' to check the packages that are now available.[root@server1 yum.repos.d]# yum list postgres*
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * addons: mirrors.seas.harvard.edu
 * base: centos.mirror.choopa.net
 * extras: centos.mirror.nac.net
 * updates: mirror.net.cen.ct.gov
pgdg90                                                   | 2.8 kB     00:00
pgdg90/primary_db                                        |  57 kB     00:00
Excluding Packages from CentOS-5 - Base
Finished
Excluding Packages from CentOS-5 - Updates
Finished
Installed Packages
postgresql-libs.x86_64                    8.1.18-2.el5_4.1             installed
Available Packages
postgresql-jdbc90.x86_64                  9.0.801-1PGDG.rhel5          pgdg90
postgresql-jdbc90-debuginfo.x86_64        9.0.801-1PGDG.rhel5          pgdg90
postgresql90.x86_64                       9.0.4-1PGDG.rhel5            pgdg90
postgresql90-contrib.x86_64               9.0.4-1PGDG.rhel5            pgdg90
postgresql90-debuginfo.x86_64             9.0.4-1PGDG.rhel5            pgdg90
postgresql90-devel.x86_64                 9.0.4-1PGDG.rhel5            pgdg90
postgresql90-docs.x86_64                  9.0.4-1PGDG.rhel5            pgdg90
postgresql90-jdbc.x86_64                  9.0.801-1PGDG.rhel5          pgdg90
postgresql90-jdbc-debuginfo.x86_64        9.0.801-1PGDG.rhel5          pgdg90
postgresql90-libs.i386                    9.0.4-1PGDG.rhel5            pgdg90
postgresql90-libs.x86_64                  9.0.4-1PGDG.rhel5            pgdg90
postgresql90-odbc.x86_64                  09.00.0200-1PGDG.rhel5       pgdg90
postgresql90-odbc-debuginfo.x86_64        09.00.0200-1PGDG.rhel5       pgdg90
postgresql90-plperl.x86_64                9.0.4-1PGDG.rhel5            pgdg90
postgresql90-plpython.x86_64              9.0.4-1PGDG.rhel5            pgdg90
postgresql90-pltcl.x86_64                 9.0.4-1PGDG.rhel5            pgdg90
postgresql90-python.x86_64                4.0-2PGDG.rhel5              pgdg90
postgresql90-python-debuginfo.x86_64      4.0-2PGDG.rhel5              pgdg90
postgresql90-server.x86_64                9.0.4-1PGDG.rhel5            pgdg90
postgresql90-test.x86_64                  9.0.4-1PGDG.rhel5            pgdg90
postgresql_autodoc.noarch                 1.40-1.rhel5                 pgdg90
[root@server1 yum.repos.d]#
We can now install PostgreSQL 9 using yum:yum install postgresql90 postgresql90-devel postgresql90-server postgresql90-libs[root@server1 ~]# yum install postgresql90 postgresql90-devel postgresql90-server postgresql90-libs
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * addons: mirrors.seas.harvard.edu
 * base: centos.mirror.choopa.net
 * extras: centos.mirror.nac.net
 * updates: mirror.net.cen.ct.gov
Excluding Packages from CentOS-5 - Base
Finished
Excluding Packages from CentOS-5 - Updates
Finished
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package postgresql90.x86_64 0:9.0.4-1PGDG.rhel5 set to be updated
--> Processing Dependency: libxslt.so.1()(64bit) for package: postgresql90
---> Package postgresql90-devel.x86_64 0:9.0.4-1PGDG.rhel5 set to be updated
---> Package postgresql90-libs.i386 0:9.0.4-1PGDG.rhel5 set to be updated
--> Processing Dependency: libldap_r-2.3.so.0 for package: postgresql90-libs
---> Package postgresql90-libs.x86_64 0:9.0.4-1PGDG.rhel5 set to be updated
---> Package postgresql90-server.x86_64 0:9.0.4-1PGDG.rhel5 set to be updated
--> Running transaction check
---> Package libxslt.x86_64 0:1.1.17-2.el5_2.2 set to be updated
---> Package openldap.i386 0:2.3.43-12.el5_6.7 set to be updated
--> Processing Dependency: libsasl2.so.2 for package: openldap
---> Package openldap.x86_64 0:2.3.43-12.el5_6.7 set to be updated
--> Running transaction check
---> Package cyrus-sasl-lib.i386 0:2.1.22-5.el5_4.3 set to be updated
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
 Package                  Arch        Version                Repository    Size
================================================================================
Installing:
 postgresql90             x86_64      9.0.4-1PGDG.rhel5      pgdg90       1.4 M
 postgresql90-devel       x86_64      9.0.4-1PGDG.rhel5      pgdg90       1.6 M
 postgresql90-libs        i386        9.0.4-1PGDG.rhel5      pgdg90       220 k
 postgresql90-libs        x86_64      9.0.4-1PGDG.rhel5      pgdg90       218 k
 postgresql90-server      x86_64      9.0.4-1PGDG.rhel5      pgdg90       4.8 M
Installing for dependencies:
 cyrus-sasl-lib           i386        2.1.22-5.el5_4.3       base         127 k
 libxslt                  x86_64      1.1.17-2.el5_2.2       base         488 k
 openldap                 i386        2.3.43-12.el5_6.7      updates      296 k
Updating for dependencies:
 openldap                 x86_64      2.3.43-12.el5_6.7      updates      304 k

Transaction Summary
================================================================================
Install      8 Package(s)
Update       1 Package(s)
Remove       0 Package(s)

Total download size: 9.4 M
Is this ok [y/N]: y
Downloading Packages:
(1/9): cyrus-sasl-lib-2.1.22-5.el5_4.3.i386.rpm          | 127 kB     00:00
(2/9): postgresql90-libs-9.0.4-1PGDG.rhel5.x86_64.rpm    | 218 kB     00:00
(3/9): postgresql90-libs-9.0.4-1PGDG.rhel5.i386.rpm      | 220 kB     00:00
(4/9): openldap-2.3.43-12.el5_6.7.i386.rpm               | 296 kB     00:00
(5/9): openldap-2.3.43-12.el5_6.7.x86_64.rpm             | 304 kB     00:00
(6/9): libxslt-1.1.17-2.el5_2.2.x86_64.rpm               | 488 kB     00:00
(7/9): postgresql90-9.0.4-1PGDG.rhel5.x86_64.rpm         | 1.4 MB     00:01
(8/9): postgresql90-devel-9.0.4-1PGDG.rhel5.x86_64.rpm   | 1.6 MB     00:01
(9/9): postgresql90-server-9.0.4-1PGDG.rhel5.x86_64.rpm  | 4.8 MB     00:03
--------------------------------------------------------------------------------
Total                                           978 kB/s | 9.4 MB     00:09
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
  Updating       : openldap                                                1/10
  Installing     : postgresql90-libs                                       2/10
  Installing     : libxslt                                                 3/10
  Installing     : postgresql90                                            4/10
  Installing     : cyrus-sasl-lib                                          5/10
  Installing     : postgresql90-server                                     6/10
  Installing     : postgresql90-devel                                      7/10
  Installing     : openldap                                                8/10
  Installing     : postgresql90-libs                                       9/10
  Cleanup        : openldap                                               10/10

Installed:
  postgresql90.x86_64 0:9.0.4-1PGDG.rhel5
  postgresql90-devel.x86_64 0:9.0.4-1PGDG.rhel5
  postgresql90-libs.i386 0:9.0.4-1PGDG.rhel5
  postgresql90-libs.x86_64 0:9.0.4-1PGDG.rhel5
  postgresql90-server.x86_64 0:9.0.4-1PGDG.rhel5

Dependency Installed:
  cyrus-sasl-lib.i386 0:2.1.22-5.el5_4.3    libxslt.x86_64 0:1.1.17-2.el5_2.2
  openldap.i386 0:2.3.43-12.el5_6.7

Dependency Updated:
  openldap.x86_64 0:2.3.43-12.el5_6.7

Complete!
[root@server1 ~]#
We can now initialize Postgre

*note: when using Webmin, please see 'Configuring Webmin to Manage PostgreSQL9 below):

[root@server1 ~]# service postgresql-9.0 initdb
Start the Postgre server:[root@server1 ~]# service postgresql-9.0 start

Configuring Webmin to Manage PostegreSQL 9

Due to the directory structure of PostgreSQL 9, you will need to make a few changes to the Webmin management interface it let Webmin know where the Postgre files are located.

Under Servers>PostgreSQL Database Server

Click on Module Configuration.

Make the following substitutions in the System Configuration Section:

1. Path to psql command: 
Original:  /usr/bin/psql
Change to: /usr/pgsql-9.0/bin/psql

2. Command to start PostgreSQL
Original: if [ -r /etc/rc.d/init.d/rhdb ]; then /etc/rc.d/init.d/rhdb start; else /etc/rc.d/init.d/postgresql start; fi
Change to:  if [ -r /etc/rc.d/init.d/rhdb ]; then /etc/rc.d/init.d/rhdb start; else /etc/rc.d/init.d/postgresql-9.0 start; fi
3. Command to stop PostgreSQL

Original:
if [ -r /etc/rc.d/init.d/rhdb ]; then /etc/rc.d/init.d/rhdb stop; else /etc/rc.d/init.d/postgresql stop; fi
Change to: if [ -r /etc/rc.d/init.d/rhdb ]; then /etc/rc.d/init.d/rhdb stop; else /etc/rc.d/init.d/postgresql-9.0 stop; fi
4. Command to initialize PostgreSQLOriginal:if [ -r /etc/rc.d/init.d/rhdb ]; then /etc/rc.d/init.d/rhdb start; else /etc/rc.d/init.d/postgresql initdb ; /etc/rc.d/init.d/postgresql start; fi
Change to:  if [ -r /etc/rc.d/init.d/rhdb ]; then /etc/rc.d/init.d/rhdb start; else /etc/rc.d/init.d/postgresql-9.0 initdb ; /etc/rc.d/init.d/postgresql-9.0 start; fi
5. Path to postmaster PID fileOriginal: /var/run/postmaster.pidChange to: /var/run/postmaster-9.0.pid6. Paths to host access config fileOriginal: /var/lib/pgsql/data/pg_hba.confChange to: /var/lib/pgsql/9.0/data/pg_hba.conf7. Default backup repository directoryOriginal: /home/db_repositoryChange to: /var/lib/pgsql/9.0/backupsSave the configuration.If you have not alreay initialized the database, do so now by clicking the initialize database button.
Additional information and references:http://people.planetpostgresql.org/devrim/index.php?/archives/43-How-to-install-PostgreSQL-9.0-Beta-1-to-FedoraCentOSRHEL.htmlhttp://www.postgresonline.com/journal/index.php?/archives/45-An-Almost-Idiots-Guide-to-PostgreSQL-YUM.htmlhttp://www.postgresql.org/

Tomcat Manager Password

2010-07-18T13:31:00.000-07:00

This post will cover basic set up and configuration to access the Tomcat Manager interface.

After installing Tomcat 6, as shown in my previous post, you can navigate to http://yourdomain.com:8080 to access the Tomcat Manager.

With some variation, which we will note, the procedure is the same for Tomcat 5, 6, and 7 (Beta).

By default, no users or passwords are created for the Tomcat manager role.

To set a user name and password, we need to configure the tomcat-users.xml file located at $CATALINA_HOME/conf/tomcat-users.xml.

In the case of our installation, $CATALINA_HOME is located at /usr/share/apache-tomcat-6.0.26.

By default the Tomcat 6 tomcat-users.xml file will look as below.

Note that while examples are provided, the elements between the <tomcat-users> and </tomcat-users> tags have been commented-out using 

Most of what you need is explained in the file itself.

Now, in order to access Tomcat Manager we simply need to add a role, manager, and then add a user name with password and assign the user to the manager role.

I'll create a user 'david' with password 'BlogPost', and I'll assign 'david' to the manager role.

That's it! Very simple.

We added the role 'manager', and then created the username 'david' with password 'BlogSpot' and assigned the user to manager role.

IMPORTANT NOTE: For Tomcat 7.0, which is now in Beta Release, the role name is manager-gui. If configuring Tomcat 7.0, use this in place of 'manager':

Now, restart your Tomcat instance, and verify that you are able to access the Tomcat Manager at http://yourdomain.com:8080.

Click on the Tomcat Manager link on the Administration menu and enter the user name and password you created above.

Securing Your Tomcat Manager Password: Creating an SHA or MD5 Digest Password

You could stop here, but since the password is stored in plain text in the tomcat-users.xml file, it's a good idea to encrypt your password.

By default, Tomcat employs a simple, file based UserDatabase Realm for security. In this case, passwords are stored in plain text in the tomcat-users.xml file we configured above.

There are much stronger security Realms that can be used such as JNDI and JDBC, but we'll start with the simplest and create a Digested version of our password we created above.

For our Digest algorithm we can use SHA or MD5.

We can do this in a few simple steps.

First, we create a Digest version of our password using the digest.sh script located at $CATALINA_HOME/bin/digest.sh

For SHA, we use issue ./digest.sh -a sha BlogSpot as shown below.

[root@server1 bin]# ./digest.sh -a sha BlogSpot
BlogSpot:89fc9f60780695d50b5cf5b0598957fc88c91487

We then copy the output, 89fc9f60780695d50b5cf5b0598957fc88c91487, which is our SHA Digest password. Copy it somewhere safe, you will need it in a moment.

Similarly, for MD5, we issue ./digest.sh -a md5 BlogSpot as shown below.

[root@server1 bin]# ./digest.sh -a md5 BlogSpot
BlogSpot:f105429be7c7a3518f9376b3de4f0f1d

We then copy the output, f105429be7c7a3518f9376b3de4f0f1d, which is our MD5 Digest password. Copy it somewhere safe, you will need it in a moment.

Now, in our tomcat-users.xml file, replace the plain text password we created 'BlogSpot' (or whatever you used) with the SHA or MD5 Digest password you generated above. I'm going to use SHA.

[root@server1 conf]# vi tomcat-users.xml

Finally, we need to make an adjustment to our server.xml file, located in the Tomcat conf directory, so Tomcat knows we are using a Digest password as well as the Digest algorithm we selected (SHA or MD5).

In your server.xml file, look for this section:


   resourceName="UserDatabase"/>

At the end of the entry, we add: digest="sha" as shown below if we used the SHA Digest Algorithm.


resourceName="UserDatabase" digest="sha" />

If we used the MD5, we add digest="md5" as shown below.


resourceName="UserDatabase" digest="md5" />

We have now created the manager role, added a user with password to the manager role, as well as encrypted our user password using MD5 or SHA Digest.

Later we'll look at JDBC and JNDI security Realms, as well as other measures for securing your Tomcat installation.

Related Posts:
Install Tomcat 6 on CentOS
Tomcat Oracle JDBC Connection
Tomcat Custom 404 Page

Tomcat 7 Beta Release

2010-07-06T06:20:00.000-07:00

Tomcat 7.0.0 Beta was released on June 29th.

http://tomcat.apache.org/tomcat-7.0-doc/index.html

"The Apache Tomcat Project is proud to announce the release of version 7.0.0 beta of Apache Tomcat. This release is the first Apache Tomcat release to support the Servlet 3.0, JSP 2.2 and EL 2.2 specifications. In addition, it includes numerous other improvements such as web application memory leak detection and prevention, extensive internal code clean-up and support for including external content directly in a web application (aliases)."

The list of improvements and additional features looks like exciting stuff.

I just got started playing with it a few days ago, the baseline installation is as Tomcat 6 (see my previous post here).

One configuration change I came across off the bat is the need to use the role of manager-gui, replacing the old manager role:

Well, I hope to be posting much more soon......

Install Tomcat 6 on CentOS

2010-07-04T16:00:00.000-07:00

This post will cover installation and configuration of Tomcat 6 on CentOS 5.

We will also show how to run Tomcat as a service, create a start/stop script, and configure Tomcat to run under a non-root user.

This post has been updated for Tomcat 6.0.32.

This post below will work with any Tomcat 6.x version, but I have been keeping it updated to keep the links consistent and to make it as "copying-and-paste" as possible.

If you are looking for our tutorial on installing Tomcat 7 on CentOS/RHEL, you can find it here.

This installation of Tomcat 6.0.32 was done on CentOS 5.5, but any CentOS 5.x should work, as well as RHEL and Fedora.

If you do not already have the Java Development Kit (JDK) installed on your machine, you will need to download and install the required JDK for your platform.

If you do have the JDK installed, you can skip to: Step 2: Download and Install the Tomcat 6.0.32:

Step 1: Install the JDK

[root@blanche ~]# mv jdk-6u24-linux-x64.bin /opt/jdk-6u24-linux-x64.bin

Create a new directory /usr/java.

[root@blanche ~]# mkdir /usr/java

Change to the /usr/java directory we created and install the JDK using 'sh /opt/jdk-6u24-linux-x64.bin'

[root@blanche ~]# cd /usr/java
[root@blanche java]# sh /opt/jdk-6u24-linux-x64.bin

Set the JAVA_HOME path. This is where we installed our JDK above.

To set it for your current session, you can issue the following from the CLI:

[root@blanche java]# JAVA_HOME=/usr/java/jdk1.6.0_24
[root@blanche java]# export JAVA_HOME
[root@blanche java]# PATH=$JAVA_HOME/bin:$PATH
[root@blanche java]# export PATH

To set the JAVA_HOME for users, we add below to the user ~/.bashrc or ~/.bash_profile of the user. We can also add it /etc/profile and then source it to give to all users.

JAVA_HOME=/usr/java/jdk1.6.0_24
export JAVA_HOME
PATH=$JAVA_HOME/bin:$PATH
export PATH

Once you have added the above to ~/.bash_profile or ~/.bashrc, you should log out, then log back in and check that the JAVA_HOME is set correctly.

[root@blanche ~]#  echo $JAVA_HOME
/usr/java/jdk1.6.0_24

Step 2: Download and Install Tomcat 6.0.32:

Download apache-tomcat-6.0.32.tar.gz here

Save the file to a directory. I'm saving it to /root/apache-tomcat-6.0.32.tar.gz

Before proceeding, you should verify the MD5 Checksum for your Tomcat download (or any other download).

Since we saved the Tomcat download to /root/apache-tomcat-6.0.32.tar.gz, we'll go to the /root directory and use the md5sum command.

[root@blanche ~]# md5sum apache-tomcat-6.0.32.tar.gz
082a0707985b6c029920d4d6d5ec11cd

Compare the output above to the MD5 Checksum provided by the Apache Tomcat MD5 page and insure that they match exactly. (There is also a link to display the MD5 checksum located just to the right off the download link).

Now, move (mv) or copy (cp) the file to the /usr/share directory:

[root@blanche ~]# mv apache-tomcat-6.0.32.tar.gz /usr/share/apache-tomcat-6.0.32.tar.gz

Change to the /usr/share directory and unpack the file using tar -xzf:

[root@blanche ~]# cd /usr/share
[root@sv2 blanche ]# tar -xzf apache-tomcat-6.0.32.tar.gz

This will create the directory /usr/share/apache-tomcat-6.0.32

At this point, you could start Tomcat via the Tomcat bin directory using the Tomcat startup.sh script located at /usr/share/apache-tomcat-6.0.32/bin.

[root@blanche share]# cd /usr/share/apache-tomcat-6.0.32/bin
[root@blanche bin]# ./startup.sh

Step 3: How to Run Tomcat as a Service.

[root@blanche share]# cd /etc/init.d
[root@blanche init.d]# vi tomcat

#!/bin/bash
# description: Tomcat Start Stop Restart
# processname: tomcat
# chkconfig: 234 20 80
JAVA_HOME=/usr/java/jdk1.6.0_24
export JAVA_HOME
PATH=$JAVA_HOME/bin:$PATH
export PATH
CATALINA_HOME=/usr/share/apache-tomcat-6.0.32


case $1 in
start)
sh $CATALINA_HOME/bin/startup.sh
;; 
stop)   
sh $CATALINA_HOME/bin/shutdown.sh
;; 
restart)
sh $CATALINA_HOME/bin/shutdown.sh
sh $CATALINA_HOME/bin/startup.sh
;; 
esac    
exit 0

The above script is simple and contains all of the basic elements you will need to get going.

As you can see, we are simply calling the startup.sh and shutdown.sh scripts located in the Tomcat bin directory (/usr/share/apache-tomcat-6.0.32/bin).

You can adjust your script according to your needs and, in subsequent posts, we'll look at additional examples.

CATALINA_HOME is the Tomcat home directory (/usr/share/apache-tomcat-6.0.32)

Now, set the permissions for your script to make it executable:

[root@blanche init.d]# chmod 755 tomcat

We now use the chkconfig utility to have Tomcat start at boot time. In my script above, I am using chkconfig: 244 20 80. 2445 are the run levels and 20 and 80 are the stop and start priorities respectively. You can adjust as needed.

[root@blanche init.d]# chkconfig --add tomcat
[root@blanche init.d]# chkconfig --level 234 tomcat on

Verify it:

[root@blanche init.d]# chkconfig --list tomcat
tomcat          0:off   1:off   2:on    3:on    4:on    5:off   6:off

Now, let's test our script.

Start Tomcat:

[root@blanche ~]# service tomcat start
Using CATALINA_BASE:   /usr/share/apache-tomcat-6.0.32
Using CATALINA_HOME:   /usr/share/apache-tomcat-6.0.32
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-6.0.32/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_24
Using CLASSPATH:       /usr/share/apache-tomcat-6.0.32/bin/bootstrap.jar

Stop Tomcat:

[root@blanche ~]# service tomcat stop
Using CATALINA_BASE:   /usr/share/apache-tomcat-6.0.32
Using CATALINA_HOME:   /usr/share/apache-tomcat-6.0.32
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-6.0.32/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_24
Using CLASSPATH:       /usr/share/apache-tomcat-6.0.32/bin/bootstrap.jar

Restarting Tomcat (Must be started first):

[root@blanche ~]# service tomcat restart
Using CATALINA_BASE:   /usr/share/apache-tomcat-6.0.32
Using CATALINA_HOME:   /usr/share/apache-tomcat-6.0.32
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-6.0.32/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_24
Using CLASSPATH:       /usr/share/apache-tomcat-6.0.32/bin/bootstrap.jar
Using CATALINA_BASE:   /usr/share/apache-tomcat-6.0.32
Using CATALINA_HOME:   /usr/share/apache-tomcat-6.0.32
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-6.0.32/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_24
Using CLASSPATH:       /usr/share/apache-tomcat-6.0.32/bin/bootstrap.jar

We should review the Catalina.out log located at /usr/share/apache-tomcat-6.0.32/logs/catalina.out and check for any errors.

[root@blanche init.d]# more /usr/share/apache-tomcat-6.0.32/logs/catalina.out

We can now access the Tomcat Manager page at:

http://yourdomain.com:8080 or http://yourIPaddress:8080 and we should see the Tomcat home page.

Step 5 (Optional): How to Run Tomcat using Minimally Privileged (non-root) User.

[root@blanche ~]# groupadd tomcat
[root@blanche ~]# useradd -s /bin/bash -g tomcat tomcat

2. Create the user 'tomcat' and add this user to the tomcat group we created above.

[root@blanche ~]# groupadd tomcat
[root@blanche ~]# useradd -s /bin/bash -g tomcat tomcat

The above will create a home directory for the user tomcat in the default user home as /home/tomcat

If we want the home directory to be elsewhere, we simply specify so using the -d switch.

[root@blanche ~]# useradd -g tomcat -d /usr/share/apache-tomcat-6.0.32/tomcat tomcat

The above will create the user tomcat's home directory as /usr/share/apache-tomcat-6.0.32/tomcat

3. Change ownership of the tomcat files to the user we created above:

[root@blanche ~]# chown -Rf tomcat.tomcat /usr/share/apache-tomcat-6.0.32/

Note: it is possible to enhance our security still further by making certain files and directory read-only. This will not be covered in this post and care should be used when setting such permissions.

4. Adjust the start/stop service script we created above. In our new script, we need to su to the user tomcat:

#!/bin/bash
# description: Tomcat Start Stop Restart
# processname: tomcat
# chkconfig: 234 20 80
JAVA_HOME=/usr/java/jdk1.6.0_24
export JAVA_HOME
PATH=$JAVA_HOME/bin:$PATH
export PATH
TOMCAT_HOME=/usr/share/apache-tomcat-6.0.32/bin


case $1 in
start)
/bin/su tomcat $TOMCAT_HOME/startup.sh
;; 
stop)   
/bin/su tomcat $TOMCAT_HOME/shutdown.sh
;; 
restart)
/bin/su tomcat $TOMCAT_HOME/shutdown.sh
/bin/su tomcat $TOMCAT_HOME/startup.sh
;; 
esac    
exit 0

Step 6 (Optional): How to Run Tomcat on Port 80 as Non-Root User.

Note: the following applies when you are running Tomcat in "stand alone" mode. That is, you are running Tomcat without Apache in front of it.

To run services below port 1024 as a user other than root, you can add the following to your IP tables:

[root@blanche ~]# iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080  
[root@blanche ~]# iptables -t nat -A PREROUTING -p udp -m udp --dport 80 -j REDIRECT --to-ports 8080

Related Posts:
Tomcat Oracle JDBC Connection
Tomcat Manager Password
Tomcat Custom 404 Page
Install Tomcat 7 on CentOS/RHEL

Learn More About Apache Tomcat

Apache Tomcat Foundation
Tomcat 6

How to Set Hostname on CentOS (RHEL)

2010-06-28T13:39:00.000-07:00

Setting the hostname on CentOS (RHEL).

Well, I could have sworn when I ordered this VPS that I entered the hostname I wanted in the order form. I guess I must have been hallucinating....

Begin by checking the existing hostname using the hostname command.

login as: root
root@vps12's password:
Last login: Mon Jun 28 16:21:53 2010
[root@vps12 ~]# hostname
vps12

We can also check via sysctl kernel.hostname

[root@vps12 ~]# sysctl kernel.hostname
kernel.hostname = vps12

The actual hostname I need to set for this server is blanche.mydomain.net

I can set the hostname initially using the hostname command followed by the desired hostname.

[root@vps12 ~]# hostname blanche.mydomain.net

This will set the hostname:

[root@vps12 ~]# hostname
blanche.mydomain.net

However, once the server is rebooted, the hostname will revert to it's previous setting (vps12).

To permanently change the hostname, I need to edit the network file at /etc/sysconfig/network.

So,

[root@vps12 ~]# cd /etc/sysconfig
[root@vps12 sysconfig]# vi network

The Network file will look as so.

NETWORKING=yes
HOSTNAME=vps12
GATEWAYDEV=eth0
GATEWAY=192.168.0.1

Hit 'i' to insert and change the HOSTNAME value to your FQDN, in my case, blanche.mydomain.net

Hit Escape, then :wq to save and exit.

Check that the hostname is properly set:

[root@vps12 sysconfig]# hostname
blanche.mydomain.net
[root@vps12 sysconfig]# sysctl kernel.hostname
kernel.hostname = blanche.mydomain.net

Finally, if we log out, and log back in using a new session, we see I am now root@blanche:

login as: root
root@blanche's password:
Last login: Mon Jun 28 16:21:53 2010
[root@blanche ~]#

To properly check, you may wish to reboot the server.

How to Enable Root Login (CentOS / RHEL)

2010-06-28T11:05:00.000-07:00

Disclaimer: It's always best practice that any machine on the internet not allow direct Root login via SSH.

To allow Root to log in, we need to update our sshd_config file located at /etc/ssh/sshd_config.

To update this file, we need to switch over to Root:

[admin@blanche ~]$ su root
Password:
[root@blanche ~]#

Go to the /ect/ssh directory:

[root@blanche ~]# cd /etc/ssh
[root@blanche ssh]#

Now, let's edit our sshd_config file using vi:

[root@blanche ssh]# vi sshd_config

Look for the following section (about 1/3 of the way down):

#LoginGraceTime 2m
PermitRootLogin no

Hit "i" to insert and then change the value for PermitRootLogin from no to yes.

Hit Escape and then :wq! to save changes and close the file.

Finally, still as Root, we need to restart SSHD using /etc/init.d/sshd restart.

[root@blanche ssh]# /etc/init.d/sshd restart
Stopping sshd:                                             [  OK  ]
Starting sshd:                                             [  OK  ]

Exit your session, open a new terminal and confirm you are now able to login as Root:

login as: root
root@blanche's password:
Last login: Mon Jun 28 16:21:53 2010
[root@blanche ~]#

Install Webmin on CentOS 5

2010-06-05T22:13:00.000-07:00

Some months ago, the download url for Webmin was updated.

You can find the latest release at: http://www.webmin.com/download.html

SSH to your server.

[root@server7]# yum -y install perl-Net-SSLeay

Get the rpm.

[root@server7]# wget http://prdownloads.sourceforge.net/webadmin/webmin-1.510-1.noarch.rpm

Verify using MD5 - Webmin also offers PGP Verification.

To do this, use the md5sum command

[root@server7]# md5sum webmin-1.510-1.noarch.rpm
7d7167b0f62e7f0a5578a6117581c46f  webmin-1.510-1.noarch.rpm

Compare the output above to the official MD5 Checksum on the Webmin Site.

The MD5 Checksum listed on the Webmin site, 7d7167b0f62e7f0a5578a6117581c46f, matches our output above, so we are ready to install.

Install the rpm.

[root@server7]# rpm -i webmin-1.510-1.noarch.rpm

You should get a message at the end of the install informing you that you can reach the installation at:

https://hostname(or server IP):10000

Bash Script for Oracle Data Pump Export (with FTP and Email)

2010-05-24T15:57:00.000-07:00

Red Hat Linux 5.4 or CentOS 5.4
Oracle 11g or 10g
SID = orcl

This post covers creating a basic bash script to produce a Data Pump export file (.dmp) file which we can then FTP to a remote server or mail the file using MUTT.

We'll also generate a log file of the export and write the output of the log file into the body of an email notification.

In the first scenario, we want to email the export file as an attachment, so we''ll need to do the following:

Export the Scott schema on a daily basis using Data Pump.
Create a log file of the Data Pump export
Add the date and hour of the export to to the file name and log file in the forms of : scott-yyyymmddhh.dmp. and scottLOG-yyyymmddhh.log
Use zip or gzip to compress the dump file for easier FTP and/or mailing
Write the contents of the log file into the body of an email.
FTP the file or attach the file to the email and send it.

To begin, you will need to create an Oracle directory to export the file to and then grant read and write on the directory for the schema.

SQL> CREATE OR REPLACE DIRECTORY backdir AS /home/app/oracle/admin/orcl/dpdump

SQL> GRANT READ, WRITE ON DIRECTORY backdir TO scott;

If not already installed, install MUTT:

[root@server1]# yum install mutt

Create your bash script.

In the first example, we'll zip the export, attach it to an email and place the export log into the body of the email.

I'm creating mine in /usr/lib/myscripts and the file name will be scottscript.sh

[root@server1]# cd /usr/lib/myscripts
[root@server1]# vi scottscript.sh

#!/bin/sh
ORACLE_HOME=/home/app/oracle/product/11.2.0/dbhome_1
export ORACLE_HOME
export PATH=$ORACLE_HOME/bin:$PATH
ORACLE_SID=orcl; export ORACLE_SID
expdp scott/tiger DIRECTORY=backdir DUMPFILE=scott-$(date +%Y%m%d%H) VERSION=10.2 LOGFILE=scottLOG-$(date +%Y%m%d%H).log
zip -r /home/app/oracle/admin/orcl/dpdump/scott-$(date +%Y%m%d%H).zip /home/app/oracle/admin/orcl/dpdump/scott-$(date +%Y%m%d%H).dmp
cat /home/app/oracle/admin/orcl/dpdump/scottLOG-$(date +%Y%m%d%H).log | mutt -s "scott Backup" -a /home/app/oracle/admin/orcl/dpdump/scott-$(date +%Y%m%d%H).zip scott@tiger.com

What is in the script:

In the first part of the script, we set the required environment.

ORACLE_HOME=/home/app/oracle/product/11.2.0/dbhome_1
export ORACLE_HOME
export PATH=$ORACLE_HOME/bin:$PATH
ORACLE_SID=orcl; export ORACLE_SID

In the next bit, we do our export. In this case, I want to import my file into a local XE instance on my laptop so I'm going to specify VERSION=10.2. Additionally, because I will be doing this daily, I am appending the date in the form of YYYYMMDDHH to the file name:

expdp scott/tiger DIRECTORY=backdir DUMPFILE=scott-$(date +%Y%m%d%H) VERSION=10.2

Create a log file of our export to see if there were any issues:

LOGFILE=scottLOG-$(date +%Y%m%d%H).log

Compress the .dmp file to make it easier to mail:

zip -r scott-$(date +%Y%m%d%H).zip /home/app/oracle/admin/orcl/dpdump/scott-$(date +%Y%m%d%H).dmp

Finally, we use MUTT to attach our export file to our email as well as write the log file contents to the body of the email:

cat /home/app/oracle/admin/orcl/dpdump/scottLOG-$(date +%Y%m%d%H).log |  mutt -s "Scott Backup" -a  /home/app/oracle/admin/orcl/dpdump/scott-$(date +%Y%m%d%H).zip scott@tiger.com

In the last bit above:

cat /home/app/oracle/admin/orcl/dpdump/scottLOG-$(date +%Y%m%d%H).log writes the contents of the log file into the body of the email.
"Scott Backup" is the email subject line.
-a /home/app/oracle/admin/orcl/dpdump/scott-$(date +%Y%m%d%H).zip attaches our file to the email.
scott@tiger.com is the recipient address.

From here, you can set a cron job to automate running the script at whatever interval you require.

Now, instead of emailing the zip file, let's FTP the file to a remote server.

In this case, we want to FTP the file, so we'll need to do the following:

Export the Scott schema on a daily basis using Data Pump.
Create a log file of the Data Pump export
Add the date and hour of the export to to the file name and log file in the forms of : scott-yyyymmddhh.dmp. and scottLOG-yyyymmddhh.log
Use zip or gzip to compress the dump file for easier FTP
Write the contents of the log file into the body of an email notification.
FTP the file.

#!/bin/sh
ORACLE_HOME=/home/app/oracle/product/11.2.0/dbhome_1
export ORACLE_HOME
export PATH=$ORACLE_HOME/bin:$PATH
ORACLE_SID=orcl; export ORACLE_SID
HOST='192.168.0.2'
USER='ftpuser'
PASSWD='password'
expdp scott/tiger DIRECTORY=backdir DUMPFILE=scott-$(date +%Y%m%d%H) VERSION=10.2 LOGFILE=scottLOG-$(date +%Y%m%d%H).log
zip -r /home/app/oracle/admin/orcl/dpdump/scott-$(date +%Y%m%d%H).zip /home/app/oracle/admin/orcl/dpdump/scott-$(date +%Y%m%d%H).dmp
cat /home/app/oracle/admin/orcl/dpdump/scottLOG-$(date +%Y%m%d%H).log | mutt -s "scott Backup" scott@tiger.com
cd /home/app/oracle/admin/orcl/dpdump
ftp -n -v $HOST << EOT
binary
user $USER $PASSWD
prompt
put scott-$(date +%Y%m%d%H).zip
bye
EOT

What is in the script:

In the first part of the script, we set the required environment.

ORACLE_HOME=/home/app/oracle/product/11.2.0/dbhome_1
export ORACLE_HOME
export PATH=$ORACLE_HOME/bin:$PATH
ORACLE_SID=orcl; export ORACLE_SID

Next, we set our FTP information:

HOST='192.168.0.2'
USER='ftpuser'
PASSWD='password'

In the next bit, we do our export. Again, I want to import my file into a local XE instance on my laptop so I'm going to specify VERSION=10.2. Additionally, because I will be doing this daily, I am appending the date in the form of YYYYMMDDHH to the file name:

expdp scott/tiger DIRECTORY=backdir DUMPFILE=scott-$(date +%Y%m%d%H) VERSION=10.2

Create a log file of our export to see if there were any issues:

LOGFILE=scottLOG-$(date +%Y%m%d%H).log

Compress the .dmp file to make it easier to FTP:

zip -r scott-$(date +%Y%m%d%H).zip /home/app/oracle/admin/orcl/dpdump/scott-$(date +%Y%m%d%H).dmp

Now, we use MUTT to write the log file contents to the body of an email notification:

cat /home/app/oracle/admin/orcl/dpdump/scottLOG-$(date +%Y%m%d%H).log | mutt -s "Scott Backup"  scott@tiger.com

In the bit above:

cat /home/app/oracle/admin/orcl/dpdump/scottLOG-$(date +%Y%m%d%H).log writes the contents of the log file into the body of the email.

"Scott Backup" is the email subject line.

scott@tiger.com is the recipient address.

Finally, we go our backup directory and FTP the file in binary mode.

cd /home/app/oracle/admin/orcl/dpdump
ftp -n -v $HOST << EOT
binary
user $USER $PASSWD
prompt
put scott-$(date +%Y%m%d%H).zip
bye
EOT

Again, you now create a cron job to automate running the script at whatever interval you require.

What if I want to use tar/gzip instead of zip?

Simply make the substitutions as below:

#!/bin/sh
ORACLE_HOME=/home/app/oracle/product/11.2.0/dbhome_1
export ORACLE_HOME
export PATH=$ORACLE_HOME/bin:$PATH
ORACLE_SID=orcl; export ORACLE_SID
HOST='192.168.0.2'
USER='ftpuser'
PASSWD='password'
expdp scott/tiger DIRECTORY=backdir DUMPFILE=scott-$(date +%Y%m%d%H) VERSION=10.2 LOGFILE=scottLOG-$(date +%Y%m%d%H).log 
tar -cvzf /home/app/oracle/admin/orcl/dpdump/scott-$(date +%Y%m%d%H).tar.gz home/app/oracle/admin/orcl/dpdump/scott-$(date +%Y%m%d%H).dmp
cat /home/app/oracle/admin/orcl/dpdump/scottLOG-$(date +%Y%m%d%H).log | mutt -s "scott Backup" scott@tiger.com
cd /home/app/oracle/admin/orcl/dpdump
ftp -n -v $HOST << EOT
binary
user $USER $PASSWD
prompt
put scott-$(date +%Y%m%d%H).tar.gz
bye
EOT

You can also execute it on-demand as well via command line: [root@server1]# cd /usr/lib/myscripts [root@server1]# . /scottscript.sh

More About Oracle Datapump

More about MUTT

Install PAE Kernel and Update Grub CentOS 5.x

2009-12-19T17:17:00.000-08:00

On my new 32-bit CentOS 5.3 server with 4GIG of RAM only 3+ GIG are visible:

[root@server1 ~]# free -m
total used free shared buffers cached
Mem: 3280 275 3005 0 15 106
-/+ buffers/cache: 154 3126
Swap: 1788 0 1788
[root@server1 ~]# top
top - 19:19:01 up 4 min, 1 user, load average: 0.07, 0.27, 0.14
Tasks: 117 total, 2 running, 115 sleeping, 0 stopped, 0 zombie
Cpu(s): 0.0%us, 0.0%sy, 0.0%ni, 99.8%id, 0.2%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 3359720k total, 282788k used, 3076932k free, 15580k buffers
Swap: 1831400k total, 0k used, 1831400k free, 108888k cached

For x86 systems that support PAE, you will need to install the kernel-PAE package to see your RAM.

From CentOS 5 FAQ:

kernel-PAE (x86-only): Contains a kernel with support for 64GB of memory on x86 systems through Physical Address Extensions (PAE). Only x86 CPUs that support PAE can run this kernel. This kernel is provided because x86 systems can't address more than 4GB of memory without PAE extensions.

1. Install kernel-PAE:

[root@server1 ~]# yum install kernel-PAE

2. Update grub.conf to boot from PAE kernel. After installing, vi /boot/grub/grub.conf and look for the line "default=..".

The value determines the default boot kernel and the sequence begins with 0. Review the kernel titles and update the default to the PAE kernel you installed (0 in my case below) and :wq

[root@server1 ~]# vi /boot/grub/grub.conf

grub.conf generated by anaconda
#
# Note that you do not have to rerun grub after making changes to this file
# NOTICE:  You do not have a /boot partition.  This means that
#          all kernel and initrd paths are relative to /, eg.
#          root (hd0,0)
#          kernel /boot/vmlinuz-version ro root=/dev/md0
#          initrd /boot/initrd-version.img
#boot=/dev/md0
default=0
timeout=5
splashimage=(hd0,0)/boot/grub/splash.xpm.gz
hiddenmenu
title CentOS (2.6.18-164.9.1.el5PAE)
        root (hd0,0)
        kernel /boot/vmlinuz-2.6.18-164.9.1.el5PAE ro root=/dev/md0
        initrd /boot/initrd-2.6.18-164.9.1.el5PAE.img
title CentOS (2.6.18-8.el5)
        root (hd0,0)
        kernel /boot/vmlinuz-2.6.18-8.el5 ro root=/dev/md0
        initrd /boot/initrd-2.6.18-8.el5.img
~
~
"/boot/grub/grub.conf" 21L, 742C

3. Reboot and check:

[root@server1 ~]# free -m
total used free shared buffers cached
Mem: 4042 955 3087 0 175 583
-/+ buffers/cache: 196 3846
Swap: 4000 0 4000
[root@server1 ~]# top
top - 01:04:22 up 2 days, 2:34, 1 user, load average: 0.05, 0.16, 0.15
Tasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie
Cpu(s): 6.1%us, 9.2%sy, 0.0%ni, 68.1%id, 0.8%wa, 0.4%hi, 15.3%si, 0.0%st
Mem: 4139764k total, 978236k used, 3161528k free, 179280k buffers
Swap: 4096440k total, 0k used, 4096440k free, 597708k cached

Jasper Reports Create a Union Query in iReport

2009-10-18T15:25:00.000-07:00

This is a simple, step by step guide to creating a union query using Jasper's iReport.

For my sample, I am using a single table, "BookList", that contains data for a local library.

In my sample table, regular book titles have an ISBN number, but the library also has unpublished material that have an internal reference number called "LocalFileNumber".

For my Union Query, I want to select from this table the Author, Title, ISBN if available, and LocalFileNumber where ISBN is null.

Here is my sample data:

-- --------------------------------------------------------

--
-- Table structure for table `BookList`
--

CREATE TABLE IF NOT EXISTS `BookList` (
`id` int(11) NOT NULL auto_increment,
`Author` varchar(50) default NULL,
`Title` varchar(50) default NULL,
`ISBN` varchar(50) default NULL,
`LocalFileNumber` varchar(50) default NULL,
PRIMARY KEY (`id`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1 AUTO_INCREMENT=7 ;

--
-- Data for table `BookList`
--

INSERT INTO `BookList` (`id`, `Author`, `Title`, `ISBN`, `LocalFileNumber`) VALUES
(1, 'Henry James', 'The Portrait of a Lady', '0141439637', NULL),
(2, 'T.S. Eliot', 'Collected Poems', '0151189781', NULL),
(3, 'William Gaddis', 'The Recognitions', '0844667404', NULL),
(4, 'John Smith', 'History of Our Library', NULL, 'JS12345678'),
(5, 'James Merrill', 'The Changing Light at Sandover', '0307263215', NULL),
(6, 'Wendy Jones', 'Library Policy Manual', NULL, 'WJ12345678');

So, we have 4 titles with ISBN numbers, and 2 titles that use the libraries internal reference number (highlighted in bold below):

mysql> select * from BookList;
+----+----------------+--------------------------------+------------+-----------
------+
| id | Author         | Title                          | ISBN       | LocalFileNumber |
+----+----------------+--------------------------------+------------+-----------
------+
| 1 | Henry James    | The Portrait of a Lady         | 0141439637 | NULL
      |
| 2 | T.S. Eliot     | Collected Poems                | 0151189781 | NULL
      |
| 3 | William Gaddis | The Recognitions               | 0844667404 | NULL
      |
| 4 | John Smith     | History of Our Library         | NULL       | JS12345678
      |
| 5 | James Merrill | The Changing Light at Sandover | 0307263215 | NULL
      |
| 6 | Wendy Jones    | Library Policy Manual          | NULL       | WJ12345678
      |
+----+----------------+--------------------------------+------------+-----------
------+
6 rows in set (0.00 sec)

1. Start up iReport and create your connection.

2. At the Query section, add the 'BookList' table into the viewer and select Author, Title, and IBSN:

3. Right click on WHERE and select Add a Condition:

4. The WHERE clause in our first select will be ISBN IS NOT NULL

5. Now that we have our first select with our WHERE clause, right click on ROOTQUERY and select UNION

6. Note that the UNION node now appears in the query explorer pane (just above the ORDER BY node).

7. Highlight the SELECT node under Union.

8. Double click on the BookList table to add it into the pane. This time we will select Author, Title, and LocalFileNumber.

9. Right click on the WHERE node for the query and select Add Condition:

9. For our condition on this select, we will now enter WHERE ISBN IS NULL

10. Expand all of the relevant nodes so we can see our query:

11. Now, at the bottom of the Query Builder, select the SQL tab:

12. From here, we can edit our query so that both ISBN from the first select and LocalFileNumber from the second select are selected as "BookCode" as shown below:

SELECT
     booklist.`Author` AS booklist_Author,
     booklist.`Title` AS booklist_Title,
     booklist.`ISBN` AS BookCode
FROM
     `booklist` booklist
WHERE
     ISBN IS NOT NULL
UNION
SELECT
     booklist.`Author` AS booklist_Author,
     booklist.`Title` AS booklist_Title,
     booklist.`LocalFileNumber` AS BookCode
FROM
     `booklist` booklist
WHERE
     ISBN IS NULL

So we now have a query that will return Author, Title, and BookCode (ISBN or LocalFileNumber when ISBN is null).

One item you may note above is that we did not need to qualify our alias BookCode with quotation marks.

13. Click OK and review your query:

PHP MySQL Union Query

2009-10-18T15:21:00.000-07:00

Union Query with PHP and MySQL

For deailed explanation of MySQL sample data and logic, please see my Jasper Reports Query post

-- --------------------------------------------------------

--
-- Table structure for table `BookList`
--

CREATE TABLE IF NOT EXISTS `BookList` (
`id` int(11) NOT NULL auto_increment,
`Author` varchar(50) default NULL,
`Title` varchar(50) default NULL,
`ISBN` varchar(50) default NULL,
`LocalFileNumber` varchar(50) default NULL,
PRIMARY KEY (`id`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1 AUTO_INCREMENT=7 ;

--
-- Data for table `BookList`
--

INSERT INTO `BookList` (`id`, `Author`, `Title`, `ISBN`, `LocalFileNumber`) VALUES
(1, 'Henry James', 'The Portrait of a Lady', '0141439637', NULL),
(2, 'T.S. Eliot', 'Collected Poems', '0151189781', NULL),
(3, 'William Gaddis', 'The Recognitions', '0844667404', NULL),
(4, 'John Smith', 'History of Our Library', NULL, 'JS12345678'),
(5, 'James Merrill', 'The Changing Light at Sandover', '0307263215', NULL),
(6, 'Wendy Jones', 'Library Policy Manual', NULL, 'WJ12345678');

<?php
$myconn = mysql_connect("localhost","username","password");
if (!$myconn)
{
die('Could not connect: ' . mysql_error());
}

mysql_select_db("Books", $myconn);

$result = mysql_query
('select Author, Title, ISBN as "BookCode"
FROM BookList where ISBN is not null
UNION
select Author, Title, LocalFileNumber as "BookCode"
FROM BookList where ISBN is null')
or die(mysql_error());

while($row = mysql_fetch_array($result))
{
echo $row['Author'] . " " . $row['Title'] . " " .$row['BookCode'];
echo "</br>";
}

mysql_close($myconn);
?>

(and with a bit formatting.........

<?php
$myconn = mysql_connect("localhost","username","password");
if (!$myconn)
{
die('Could not connect: ' . mysql_error());
}

mysql_select_db("Books", $myconn);

$result = mysql_query('select Author, Title, ISBN as "BookCode"
FROM BookList where ISBN is not null
UNION
select Author, Title, LocalFileNumber as "BookCode"
FROM BookList where ISBN is null')
or die(mysql_error());

echo "<table border='1'>
<tr>
<th>Author</th>
<th>Title</th>
<th>BookCode</th>
</tr>";

while($row = mysql_fetch_array($result))
{
echo "<tr>";
echo "<td>" . $row['Author'] . "</td>";
echo "<td>" . $row['Title'] . "</td>";
echo "<td>" . $row['BookCode'] . "</td>";
echo "</tr>";
}
echo "</table>";

mysql_close($myconn);
?>

Install Group Office on CentOS 5.3

2009-10-10T12:22:00.000-07:00

Install Group Office on CentOS 5.3

Start Here: http://www.group-office.com/wiki/Installation

The server is going to be used primarily for Group Office, so I stayed with the script and unpacked the tar file to /var/www/html/groupoffice-pro-3.2.37

Overall, this was fairly straight forward, with the exception of having to upgrade PHP and a some brief scrounging for some rpms.

The installation package includes a test file in the root directory, gotest.php, that provides a useful summary of required items that your server is lacking. So if you don't have php configured, that should be the first order of business.

One of the reasons I use CentOS whenever possible is it's stability and it's conservative approach.

Unfortunately, this means that php >=5.2, one of the prerequisites for Group Office, was not available from the repo.

Not wanting to recompile PHP, it meant having to avail myself of Jason Litka's repository.

[root@server4 ~]# rpm --import http://www.jasonlitka.com/media/RPM-GPG-KEY-jlitka
[root@server4 ~]# vi /etc/yum.repos.d/utterramblings.repo
[utterramblings]

Enter the following and then :wq

[utterramblings]
name=Jason's Utter Ramblings Repo
baseurl=http://www.jasonlitka.com/media/EL$releasever/$basearch/
enabled=1
gpgcheck=1
gpgkey=http://www.jasonlitka.com/media/RPM-GPG-KEY-jlitka

[root@server4 ~]# yum update php
[root@server4 ~]# yum update mysqlat

After upgarding php, simply consult the gotest.php script to find missing prerequisites. In my case:

[root@server4 ~]# yum install php-imap php-xml php-mbstring php-devel
[root@server4 ~]# service httpd restart

Install Zend Ion Cube

[root@server4 ~]# wget http://downloads2.ioncube.com/loader_downloads/ioncube_loaders_lin_x86.tar.gz
[root@server4 ~]# tar -zxvf ioncube_loaders*
[root@server4 ~]# mv ioncube /var/www/html/ioncube
[root@server4 ~]# service httpd restart

After installing ion cube above, add the Zend extension in bold below to your php.ini file under Language Options before the Zend references:

;;;;;;;;;;;;;;;;;;;;
; Language Options ;
;;;;;;;;;;;;;;;;;;;;

; Enable the PHP scripting language engine under Apache.
engine = On

zend_extension = /var/www/html/ioncube/ioncube_loader_lin_5.2.so

Restart Apache:
[root@server4 ~]# service httpd restart

Check your php version is now updated and ion cube installed:

[root@server4 ~]# php -v
PHP 5.2.11 (cli) (built: Sep 21 2009 14:49:09)
Copyright (c) 1997-2009 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2009 Zend Technologies
with the ionCube PHP Loader v3.1.34, Copyright (c) 2002-2009, by ionCube Ltd.

Install libwbxml:

[root@server4 ~]# rpm -Uvh http://dl.atrpms.net/all/wbxml2-0.9.2-5.el4.at.i386.rpm

Install TNEF:

For whatever reason, I could not pull down tnef-1.3.3-1.2.el4.rf.i386.rpm from dag.wieers.com, even searching manually.

I grabbed it here: http://www.rpmfind.net/linux/rpm2html/search.php?query=tnef
saved it to temp and installed:

[root@server4 ~]# cd /var/tmp
[root@server4 ~]# rpm -Uvh tnef-1.3.3-1.2.el4.rf.i386.rpm

That was about it.

Once you cleared all of the gotest.php prerequisites, you can then start the installation via the home directory, which will walk you through the installation. Keep putty open as you will need to do some mkdir's as some chmod's.

Add your virtual host entry in your Apache httpd.conf file.

<VirtualHost *:80>
ServerAdmin david@mydomain.com
DocumentRoot /var/www/html/groupoffice-pro-3.2.37
ServerName mycal.mydomain.com
ErrorLog logs/mycal.mydomain.com-error_log
CustomLog logs/mycal.mydomain.com-access_log common
</VirtualHost>

Tune Apache according to requirements.

I originally tested using the Community Edition, groupoffice-com-2.18-stable-21, and the procedure is identical.

If you will be using the CE, the items you can skip are indicated in the gotest.php file.

Install JasperServer 3.5 on CentOS 5.3

2009-09-30T00:08:00.000-07:00

Using the bin installer, this could not have been easier.

The JasperServer 3.5 bin installer allows you the option of installing with the bundled MySQL and Tomcat server or use your own.

I used my own and also left off the optional iReport installation as I have iReport on my XP.

The last option is to install the sample data.

Just chmod 755 the installer and install:

-bash-3.2# chmod 755 jasperserver-3.5.0-linux-installer.bin
-bash-3.2# ./jasperserver-3.5.0-linux-installer.bin
----------------------------------------------------------------------------
Welcome to the JasperServer 3.5.0 Setup Wizard.

----------------------------------------------------------------------------
Please read the following License Agreement. You must accept the terms of this
agreement before continuing with the installation.

Press [Enter] to continue :

NOTICE TO USER:

PLEASE READ THIS AGREEMENT CAREFULLY. BY DOWNLOADING,
COPYING, INSTALLING OR USING ALL OR ANY PORTION
OF THIS PROGRAM YOU ACCEPT ALL THE TERMS AND CONDITIONS
OF THIS AGREEMENT, INCLUDING WITHOUT LIMITATION THE GNU
GENERAL PUBLIC LICENSE VERSION 2. YOU AGREE THAT THIS AGREEMENT
IS LIKE ANY WRITTEN NEGOTIATED AGREEMENT SIGNED BY YOU.
THIS AGREEMENT IS ENFORCEABLE AGAINST YOU AND ANY LEGAL ENTITY
THAT OBTAINED THIS PROGRAM AND ON WHOSE BEHALF IT IS USED: FOR
EXAMPLE, IF APPLICABLE, YOUR EMPLOYER. IF YOU DO NOT AGREE TO
THE TERMS OF THIS AGREEMENT, DO NOT USE THIS PROGRAM. VISIT
http://www.jaspersoft.com AND http://www.gnu.org/licenses/ FOR
TERMS AND CONDITIONS.

IF YOU HAVE PURCHASED A COMMERCIAL LICENSE AGREEMENT FROM
JASPERSOFT, YOU MAY HAVE ANOTHER WRITTEN AGREEMENT DIRECTLY WITH
JASPERSOFT THAT SUPERSEDES ALL OR PORTIONS OF THIS AGREEMENT.

JASPERSOFT PERMITS YOU TO DOWNLOAD, COPY, INSTALL, USE, OR
OTHERWISE BENEFIT FROM THE FUNCTIONALITY OR INTELLECTUAL PROPERTY
OF THIS PROGRAM ONLY IN ACCORDANCE WITH THE TERMS OF THIS
Press [Enter] to continue :
AGREEMENT. USE OF SOME THIRD PARTY MATERIALS AND SERVICES
INCLUDED IN OR ACCESSED THROUGH THIS PROGRAM MAY BE SUBJECT TO
OTHER TERMS AND CONDITIONS TYPICALLY FOUND IN A SEPARATE LICENSE
AGREEMENT, TERMS OF USE OR "READ ME" FILE LOCATED WITHIN OR NEAR
SUCH MATERIALS AND SERVICES.

Copyright (C) 2005 - 2009 Jaspersoft Corporation. All rights
reserved.

Unless you have purchased a commercial license agreement from
Jaspersoft, the following license terms apply:

This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
version 2 as published by the Free Software Foundation.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License version 2 for more details.

You can view a complete copy of the GNU General Public License at
Press [Enter] to continue :
http://www.gnu.org/licenses/. You also should receive a copy of
the GNU General Public License version 2 along with the program;
if not, write to the Free Software Foundation, Inc., 51 Franklin
Street, Fifth Floor, Boston, MA 02110-1301 USA.

Contact Jaspersoft Corporation
539 Bryant Street, Suite 100
San Francisco, CA 94107
Web: www.jaspersoft.com
General Inquiries: info@jaspersoft.com
Sales Inquiries: sales@jaspersoft.com

Press [Enter] to continue :

Do you accept this license? [y/n]: y

----------------------------------------------------------------------------
Installation Directory

Please specify the directory where JasperServer 3.5.0 will be installed.

Installation directory: [/opt/jasperserver-3.5.0]:

----------------------------------------------------------------------------
Please select the Tomcat configuration you wish to use

Tomcat installation:

[1] I wish to use the bundled Tomcat
[2] I wish to use an existing Tomcat
Please choose an option [1] : 2

----------------------------------------------------------------------------
Database Installation

Please select which database configuration you wish to use:

[1] I wish to use the bundled MySQL database
[2] I wish to use an existing MySQL database
Please choose an option [1] : 2

Setup will try to install new databases and will overwrite any existing duplicate. Do you wish you continue? [Y/n]: Y

----------------------------------------------------------------------------
Tomcat Directory

Please specify the directory where Tomcat is located.

Tomcat directory: [/opt/jasperserver-3.5.0/apache-tomcat]: /usr/share/apache-tomcat-6.0.18

----------------------------------------------------------------------------
Install Sample Data

Would you like to install sample databases and sample reports?

[Y/n]: Y

----------------------------------------------------------------------------
Install iReport

The iReport application is a graphical designer for JasperReports.
iReport connects to JasperServer to upload and download reports.

Would you like to install iReport?

[Y/n]: n

----------------------------------------------------------------------------
MySQL Information

Please enter your MySQL database information.

MySQL Binary Directory: [/opt/jasperserver-3.5.0/mysql/bin]: /usr/bin

Port: [3306]:

IP/Hostname Value Used: 127.0.0.1

----------------------------------------------------------------------------
MySQL Credentials

Please enter your MySQL database credentials.

Please enter your database root username:

Username: [root]: root

Please enter your database root user password:

Password: :
Re-enter password: :
The following JasperServer database user will be created: jasperdb/password

----------------------------------------------------------------------------
Setup is now ready to begin installing JasperServer 3.5.0 on your computer.

Do you want to continue? [Y/n]: Y

----------------------------------------------------------------------------
Please wait while Setup installs JasperServer 3.5.0 on your computer.

Installing
0% ______________ 50% ______________ 100%
########################################Info: Please shut down your application server and press OK to continue.
Press [Enter] to continue :
#

----------------------------------------------------------------------------
Setup has finished installing JasperServer 3.5.0 on your computer.

Opt-in for JasperServer Heartbeat.
Please help us build better products by Opting-in to the Heartbeat.

By allowing the Heartbeat to collect data, you confirm consent,
where relevant, from all individual users in your organization.

Please refer to: www.jaspersoft.com/heartbeat

[Y/n]:

-bash-3.2#

One initial issue I ran into was SMTP authentication errors when using the scheduler.

Thankfully, this post:

http://jasperforge.org/plugins/espforum/view.php?group_id=112&forumid=102&topicid=60508

got me sorted out.

Import XML Data into SQL Server

2009-09-20T12:45:00.000-07:00

How to automate comparing, updating, and inserting data from an XML feed against an existing SQL Server table.

I have an existing table in SQl Server called AcmeProductTable.

It contains the following columns:

AcmeProductID
AcmeProductName
AcmeProductPrice
AcmeProductStockQuantity

The Acme Product Company has a url that provides me with an XML file of the latest data for their products. The feed is located at:

http://www.acme.com/acmeproductfeed.

The task is to:

1. Get the daily XML product feed from their url
2. Save the XML file with today's date
3. Compare today's XML file with my existing data in SQL Server
4. Update any changes to price and stock quantity for existing products
5. Insert any new products
6. Automate the entire process so I don't need to do anything

Well, for someone who knows SQL Server and XML, it's a simple task. But, like me, if you are Googling SQL Server and XML well....

The place to start is here: http://support.microsoft.com/kb/316005

This gives an example of creating an XML map, which you will need to import your XML data file.

My XML map looks something like this:

<?xml version="1.0" ?>
<Schema xmlns="urn:schemas-microsoft-com:xml-data"
xmlns:dt="urn:schemas-microsoft-com:xml:datatypes"
xmlns:sql="urn:schemas-microsoft-com:xml-sql" >

<ElementType name="product_id" dt:type="string" />
<ElementType name="product_name" dt:type="string" />
<ElementType name="product_price" dt:type="string" />
<ElementType name="product_stock_quanitity" dt:type="string" />

<ElementType name="acmeproductfeed" sql:is-constant="1">
<element type="acmefeed" />
</ElementType>
<ElementType name="acmefeed" sql:relation="acmefeed">
<element type="product_id" sql:field="product_id" />
<element type="product_name" sql:field="product_name" />
<element type="product_price" sql:field="product_price" />
<element type="product_stock_quanitity" sql:field="product_stock_quanitity" />
</ElementType>

</Schema>

In order to automate comparing the XML feed from the url above to my existing data in SQL Server,the AcmeProductTable, I will need the following four items:

1. An XML Map of the Acme xml feed file (see MSDN link and my example above).
2. A vbs script that will get the latest xml file from the url, date the file with today's date, save the file, and then locate the latest saved file (today's) and use the file to create a table in SQL Server.
3. A stored procedure in SQL Server that will compare the table we created in in step 2 above with my AcmeProductTable and perform any required updating and inserting.
4. A simple batch file to automate all of above.

Firstly, I am going to save my above XML map "AcmeMap.xml" into a folder on my desktop:

C:\Documents and Settings\Administrator\Desktop\Acme\AcmeMap.xml

I am going to use this same folder for all of the other files below as well.

For my VBS scipt, I will use the following, which I have saved as "acmescript.vbs":

C:\Documents and Settings\Administrator\Desktop\Acme\acmescript.vbs

Blogging, like SQL Server, is not my forte, so I have used italic where portions should be quoted out of the script:

' VBScript source code to get the file from the url then stamp the file with todays date and save it to my Acme file folder.
The important bit here is inserting the +sDate+ into the name of the saved file

sDay = Day(Now())
If Len(sDay) = 1 Then sDay = "0" & Day(Now())
sMonth = Month(Now())
If Len(sMonth) = 1 Then sMonth = "0" & Month(Now())
sYear = Year(Now())
sDate = sYear & sMonth & sDay
strFileURL = "http://www.acme.com/acmeproductfeed"
strHDLocation = "C:\Documents and Settings\Administrator\Desktop\Acme\acmefeed"+"-"+sDate+".xml"

Set objXMLHTTP = CreateObject("MSXML2.XMLHTTP")

objXMLHTTP.open "GET", strFileURL, false
objXMLHTTP.send()

If objXMLHTTP.Status = 200 Then
Set objADOStream = CreateObject("ADODB.Stream")
objADOStream.Open
objADOStream.Type = 1 'adTypeBinary

objADOStream.Write objXMLHTTP.ResponseBody
objADOStream.Position = 0 'Set the stream position to the start

Set objFSO = Createobject("Scripting.FileSystemObject")
If objFSO.Fileexists(strHDLocation) Then objFSO.DeleteFile strHDLocation
Set objFSO = Nothing

objADOStream.SaveToFile strHDLocation
objADOStream.Close
Set objADOStream = Nothing
End if

Set objXMLHTTP = Nothing

' Now create a staging stable - acmefeed - in my database I will use this acmefeed table to compare to my existing production table AcmeProductTable. Note - make the name of the staging table the same as the element below the ROOT element of the XML file. In my case, acmefeed. There is probably some way around this, but I could not find it.

Const DB_CONNECT_STRING = "provider=SQLOLEDB.1;data source=IP;database=YourDB;uid=user;pwd=password"

Set myConn = CreateObject("ADODB.Connection")

set myCommand = CreateObject("ADODB.Command" )

myConn.Open DB_CONNECT_STRING

Set myCommand.ActiveConnection = myConn

myCommand.CommandText = "CREATE TABLE acmefeed (acmefeed nvarchar(255),product_id nvarchar(255),product_name nvarchar(255),product_price nvarchar(255),product_stock_quantity nvarchar(255))"

myCommand.Execute

myConn.Close

' Now - find today's xml file that I saved above and use my xml map to insert it into the staging table, acmefeed, in my database. Note again that I using +sDate+ in the file name to get TODAY's file

sDay = Day(Now())
If Len(sDay) = 1 Then sDay = "0" & Day(Now())
sMonth = Month(Now())
If Len(sMonth) = 1 Then sMonth = "0" & Month(Now())
sYear = Year(Now())
sDate = sYear & sMonth & sDay
Set objBL = CreateObject("SQLXMLBulkLoad.SQLXMLBulkLoad")
objBL.ConnectionString = "provider=SQLOLEDB.1;data source=IP;database=YourDB;uid=user;pwd=password"
objBL.ErrorLogFile = "C:\Documents and Settings\Administrator\Desktop\Acme\error.log"
objBL.Execute "C:\Documents and Settings\Administrator\Desktop\Acme\AcmeMap.xml", "C:\Documents and Settings\Administrator\Desktop\Acme\acmefeed"+"-"+sDate+".xml"
Set objBL = Nothing

' Now with the latest XML feed in my database in the form of a table, I can execute a stored procedure to update Price and Stock Quantity and then insert new new data into the appropriate table and then drop my acmefeed table

Const DB_CONNECT_STRINGSP = "provider=SQLOLEDB.1;data source=IP;database=YourDB;uid=user;pwd=password"

Set mySPConn = CreateObject("ADODB.Connection")

set mySPCommand = CreateObject("ADODB.Command" )

mySPConn.Open DB_CONNECT_STRINGSP

Set mySPCommand.ActiveConnection = mySPConn

mySPCommand.CommandText = "EXEC dbo.update_acmefeed"

mySPCommand.Execute

mySPConn.Close

Below is the stored procedure, "update_acmefeed", that I am executing in the vb script above. This will compare the contents of my staging table, "acmefeed", against my actual production table AcmeProductTable. It will update any existing products where the price and/or stock quantity has changed, as well as insert any new products. I then drop the staging table (acmefeed).

CREATE PROCEDURE update_acmefeed
AS
BEGIN
-- First Update any changes to price and stock quantity for existing items
-- Then insert any new items into the AcmeProductTable
-- SET NOCOUNT ON added to prevent extra result sets from
-- interfering with SELECT statements.
SET NOCOUNT ON;

declare @id varchar(255),@price numeric(9,2),@quantity varchar(255)
declare curFeed cursor for select product_id, product_price, product_quantity, from acmefeed
where exists( select AcmeProductID from AcmeProductTable where product_id=AcmeProductID)

open curFeed

Fetch next from curFeed into @id,@price,@quantity

while (@@fetch_Status = 0)
BEGIN

update AcmeProductTable set product_price=@price,product_stock_quantity=@quantity
where AcmeProductID=@id

Fetch next from curFeed into @id,@price,@quantity
end

CLOSE curFeed DEALLOCATE curFeed

insert into AcmeProductTable
select product_id, product_name,product_price,product_stock_quantity
from acmefeed A where not exists(select AcmeProductID from AcmeProductTable where AcmeProductID=a.product_id)

drop table acmefeed

END

Finally, I am going to schedule the above VBS to run daily by creating a simple batch file with the following contents:

wscript.exe C:\Documents and Settings\Administrator\Desktop\Acme\acmescript.vbs

There is obviously redundancy in the date function as well as the ADO connections, but this is the original scripting I used to get this to work.

I am sure there are more elegant ways of doing this, but I hope this helps someone...

Sources:

Download File:
http://blog.netnerds.net/2007/01/vbscript-download-and-save-a-binary-file/

Add File Date:
http://www.visualbasicscript.com/m29679.aspx

Tomcat Hangs After Restart

2009-08-14T03:00:00.000-07:00

Tomcat 6.0.18
jdk1.6.0_12
apache-ant-1.7.1
Cocoon 2.1.11

Well, I have been working with Eclipse Galileo with BIRT the past few weeks and I have to say it's one of the best finds of recent memory.

It's great to be able to develop reports on my XP laptop with Galileo's friendly IDE and then easily deploy my reports to the BIRT Report Viewer on my Centos server.

The only issue (most likely my Tomcat restart script or some other fault on my end) is that after adding a new report and restarting Tomcat, I find that the Tomcat Manager, along with the BIRT report viewer hangs.

A check showed that after restart Tomcat appears to be up:

[root@server1 ~]# ps aux | grep -i tomcat
root 24216 0.2 4.2 1186320 172692 ? Sl 14:23 0:20 /usr/java/jdk1.6.0_12/bin/java -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.util.logging.config.file=/usr/share/apache-tomcat-6.0.18/conf/logging.properties -Djava.endorsed.dirs=/usr/share/apache-tomcat-6.0.18/endorsed -classpath :/usr/share/apache-tomcat-6.0.18/bin/bootstrap.jar -Dcatalina.base=/usr/share/apache-tomcat-6.0.18 -Dcatalina.home=/usr/share/apache-tomcat-6.0.18 -Djava.io.tmpdir=/usr/share/apache-tomcat-6.0.18/temp org.apache.catalina.startup.Bootstrap start
root 24745 0.0 0.0 3900 652 pts/0 R+ 16:41 0:00 grep -i tomcat
root 27432 5.3 6.8 1209172 277096 ? Sl Jul29 56:54 /usr/java/jdk1.6.0_12/bin/java -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.util.logging.config.file=/usr/share/apache-tomcat-6.0.18/conf/logging.properties -Djava.endorsed.dirs=/usr/share/apache-tomcat-6.0.18/endorsed -classpath :/usr/share/apache-tomcat-6.0.18/bin/bootstrap.jar -Dcatalina.base=/usr/share/apache-tomcat-6.0.18 -Dcatalina.home=/usr/share/apache-tomcat-6.0.18 -Djava.io.tmpdir=/usr/share/apache-tomcat-6.0.18/temp org.apache.catalina.startup.Bootstrap start

However, after sstopping Tomcat, when I issue pas -a, there are still java processes running.

[root@server1 ~]# service tomcat stop
Shutting down tomcat: Using CATALINA_BASE: /usr/share/apache-tomcat-6.0.18
Using CATALINA_HOME: /usr/share/apache-tomcat-6.0.18
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-6.0.18/temp
Using JRE_HOME: /usr/java/jdk1.6.0_12
done.
[root@server1 ~]# ps -a
PID TTY TIME CMD
24881 pts/0 00:00:20 java
24945 pts/0 00:00:00 ps

So, issue killall -9 java:

[root@server1 ~]# killall -9 java

Look at ps again:

[root@server1 ~]# ps -a
PID TTY TIME CMD
24957 pts/0 00:00:00 ps

Now start up Tomcat:

[root@server1 ~]# service tomcat start
Starting tomcat: Using CATALINA_BASE: /usr/share/apache-tomcat-6.0.18
Using CATALINA_HOME: /usr/share/apache-tomcat-6.0.18
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-6.0.18/temp
Using JRE_HOME: /usr/java/jdk1.6.0_12
done.
[root@server1 ~]#

And now my Manager, my Report viewer, and my newly added report are all accessible.

I have been using this same Tomcat script for some time now and have never had any issues restarting after changes. So I'm not sure if it is my script (most likely), or the BIRT viewer, or some other oversight on my part.

In any event, I won't be giving up my Galileo or Report Viewer any time soon.

SSL (HTTPS) for Oracle Apex on Oracle 10g Express (XE)

2009-02-17T15:28:00.000-08:00

Adding HTTPS to Oracle Application Express on Oracle 10g Express

CentOS 5.x
Oracle 10g Express
APEX 3.x upgrade
Apache 2.x
mod_ssl
open_ssl

If you are running APEX on Oracle 10g Express, you do not have access to the Wallet Manager per the OTN agreement.

You can still add HTTPS functionality, however, via Apache using mod_ssl.

While pervasive, mod_ssl is a third party module not supplied by Apache. If not already installed, yum install mod_ssl.

Let's start with a non-HTTPS example.

Within our Apache httpd.conf file, we create a reverse proxy to our Oracle APEX application.

There are any number of reasons for doing this:

1. We might do this for domain mapping (i.e. so www.yourdomain.com resolves to a specified application ID and landing page www.yourdomain.com/apex/f?p=101:1)

2. To allow access when behind a firewall where :8080 would block access

3. To increase security by running our Apache installation on a public facing server and back-ending to our Oracle server behind a firewall through which only our Apache server has access.

To create the reverse proxy we can use the following Virtual Host configuration under /etc/httpd/conf/httpd.conf

For simplicity, in the example below, Apache is installed on the same server as Oracle. If your installation is otherwise, simply substitute your server hostname or IP for localhost below.

<VirtualHost *:80>
ServerAdmin admin@yourdomain.com
DocumentRoot /home/yourdomain.com/htdocs
ServerName yourdomain.com
ServerAlias www.yourdomain.com
ErrorLog logs/yourdomain.com-error_log
CustomLog logs/yourdomain.com-access_log common
RewriteEngine On

RewriteRule ^/$ apex/f?p=101:1 [R=301]

ProxyRequests Off
<Proxy *>
Order allow,deny
Allow from all
</Proxy>
ProxyPass / http://localhost:8080/
ProxyPassReverse / http://localhost:8080/
</VirtualHost>

Now, if we want to add HTTPS functionality, we begin by creating our SSL Key, CSR, and Certificate as we would for any standard SSL certificate.

If you have never done this before, RapidSSL has a very simple and useful step-by-step guides to doing so on Apache with OpenSSL and ModSSL:

1. Create Key and CSR: http://www.rapidssl.com/ssl-certificate-support/generate-csr/apache_mod_ssl.htm

2. Install Certificate: http://www.rapidssl.com/ssl-certificate-support/install-ssl-certificate/apache_mod_ssl.htm

If you want to take a practice run, or don't care about the certificate throwing a browser error, you can simply create a self-signed certificate.

I'm going to store my key and crt (certificate) files in the default locations.

With our certificate installed, lets return to the VHOST we created Now, under /etc/httpd/conf/httpd.conf change the Virtual Host we created above to below.

<VirtualHost *:80>
ServerAdmin admin@yourdomain.com
DocumentRoot /home/yourdomain.com/htdocs
ServerName yourdomain.com
ServerAlias www.yourdomain.com
ErrorLog logs/yourdomain.com-error_log
CustomLog logs/yourdomain.com-access_log common

RewriteEngine on

RewriteRule ^/(.*)$ https://%{HTTP_HOST}/$1 [L,R]

</VirtualHost>

The above rewrite RewriteRule ^/(.*)$ https://%{HTTP_HOST}/$1 [L,R] forces all requests made to :80 HTTP to :443 HTTPS (or whatever port you have configured to handle HTTPS requests).

Now that we have set up VHOST in httpd.conf and created our SSL key and certificate, we know need to create an additional VHOST under /etc/httpd/conf.d/ssl.conf. The ssl.conf was created when we installed mod_ssl.

Under /etc/httpd/conf.d/ssl.conf configure the Virtual Host as below. I will be creating more than one SSL domain, so I am using IP 123.456.78.90 for this domain and will specify this in the Virtual Host below.

The SSL Virtual Host in our below in our /etc/httpd/conf.d/ssl.conf file is truncated and I have highlighted the main areas where we have done our configuration in bold. I have also added a few comments in blue.

<VirtualHost 123.456.78.90:443>
# General setup for the virtual host, inherited from global configuration
DocumentRoot "/home/yourdomain.com/htdocs"
ServerName www.yourdomain.com:443

# Note that we have moved the reverse proxy from our httpd.conf file to our ssl.conf file
RewriteEngine on
RewriteRule ^/$ apex/f?p=101:1 [R=301]

ProxyRequests Off
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
ProxyPass / http://localhost:8080/
ProxyPassReverse / http://localhost:8080/

# Use separate log files for the SSL virtual host; note that LogLevel
# is not inherited from httpd.conf.
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn

# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
SSLEngine on

# SSL Protocol support:
# List the enable protocol levels with which clients will be able to
# connect. Disable SSLv2 access by default:
SSLProtocol all -SSLv2

# SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list.
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW

# Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate. If
# the certificate is encrypted, then you will be prompted for a
# pass phrase. Note that a kill -HUP will prompt again. A new
# certificate can be generated using the genkey(1) command.
# The path below gives the location where we stored the SSL certificate we created
SSLCertificateFile /etc/httpd/conf/ssl.cert/www.youdomain.com.crt

# Server Private Key:
# If the key is not combined with the certificate, use this
# directive to point at the key file. Keep in mind that if
# you've both a RSA and a DSA private key you can configure
# both in parallel (to also allow the use of DSA ciphers, etc.)
# The path below gives the location of the key we created.
SSLCertificateKeyFile /etc/httpd/conf/ssl.key/www.youdomain.com.key

SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0

CustomLog logs/ssl_request_log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>

For Oracle APEX on Windows - I have never used a local Apache installation on W2K3. The simplest method for doing the above would be to use Linux server as front end with the proxy back-ended to the APEX installation on the Windows server. In Windows Firewall, you can then open access to your Linux box.

Footnote - for those new to Apache, the above does not touch on tuning. ReverseProxy and rewrites require tuning in order to perform well. Be sure to set KeepAlive to On, use mod_deflate (or gzip for 1.3), as well as set reasonable prefork MPM and worker MPM values. Apache tuning is beyond the scope of this post, but start with checking the docs and Googling these items to get you going.

Service Temporarily Unavailable 503 Code for APEX Apache Proxy

2009-02-03T09:16:00.000-08:00

On running a standard proxypass for an apex application on new server, kept getting:

Service Temporarily Unavailable 503

vhost.....

<VirtualHost:*80>
ServerName domain.com
ServerAlias www.domain.com
DocumentRoot /var/www/html/domain.com/htdocs
ServerAdmin admin@domain.com

RewriteEngine On

RewriteRule ^/$ apex/f?p=113:1 [R=301]

ProxyRequests Off
<proxy>
Order deny,allow
Allow from all
</proxy>
ProxyPass / http://server:8080/
ProxyPassReverse / http://server:8080/
</VirtualHost>

Checking the error logs: /var/log/httpd/error_log I find:

[Sun Feb 01 21:01:42 2009] [error] (13)Permission denied: proxy: HTTP: attempt to connect to localhost:8080 (1.2.3.4) failed

In this case it was SELinux, giving me the option of either disbaling:

# vi /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - SELinux is fully disabled.
SELINUX=disabled
# SELINUXTYPE= type of policy in use. Possible values are:
# targeted - Only targeted network daemons are protected.
# strict - Full SELinux protection.
SELINUXTYPE=targeted

# SETLOCALDEFS= Check local definition changes
SETLOCALDEFS=0

Or, a more targeted:

/usr/sbin/setsebool httpd_can_network_connect 1

While in this case "(13)Permission denied:" was self-explanatory, the most common proxy failures I have come across were, in fact, due to my database not being configured on os properly.

Another area to check when your proxy stops proxying is the hostname configuration. Check /etc/hosts, /etc/hostname and make sure your hostname is set properly.

If it is, check listener.ora and tnsnames.ora under /usr/lib/oracle/xe/app/oracle/product/10.2.0/server/network/admin and make sure they match what is in your host/hostname files.

Oracle XE on OpenVZ (CentOS 4.6)

2008-12-23T16:19:00.000-08:00

While recently installing on dedicated server provisioned as a single VPS, following yum install libaio (as well as bc and flex in my case), when I issued

# rpm -ivh oracle-xe-10.2.0.1-1.0.i386.rpm

I was greeted by:

Preparing... ########################################### [100%]
error: unknown error 1 setting key 'kernel.sysrq'
error: unknown error 1 setting key 'kernel.core_uses_pid'
error: %pre(oracle-xe-10.2.0.1-1.0.i386) scriptlet failed, exit status 255
error: install: %pre scriptlet failed (2), skipping oracle-xe-10.2.0.1-1.0

XE, of course, does a sysctl -p to update the live kernel with the values of the sysctl.conf file.

In my case, it was the default RHL sysctl.conf file and .sysrq and .uses_pid could not be updated by OpenVZ to the live kernel.

In any event, re-issue # rpm -ivh oracle-xe-10.2.0.1-1.0.i386.rpm:

Preparing... ########################################### [100%]
1:oracle-xe ########################################### [100%]
Executing Post-install steps...

You must run '/etc/init.d/oracle-xe configure' as the root user to configure the database.

So, vi'ing sysctl.conf kernel.sem = 250 32000 100 128, kernel.shmmax = 536870912.

Finally, # grep . kernel/* and verify everything is good.

Happy Birthday Uriel!!!!

2008-12-23T14:33:00.000-08:00

Happy Birthday Uriel!!!!

1. Uriel, the Birthday Boy
2. Betzalel, the Birthday Brother (by law, this entitles him to both receive gifts as well as share Uriel's)
3. Elouise's lovely train cake
4. Elouise, The Birthday Mom
5. Daphna, The Birthday Sister (by law, this entitles her to be carted about the flat all day by Birthday Dad).

Oracle XE Backup with Email of Log

2008-12-23T09:09:00.000-08:00

To receive a inline copy of your back up log, add the line in bold below to your backup.sh.

Also comment out the two lines in italic.

This assumes you are running in achieve log mode - which, of course, you are :)

#Display the result to user
if [ $failed = 'true' ] ; then
echo '==================== ERROR ========================='
echo ' Backup of the database failed '
echo '==================== ERROR ========================='
echo ${errstr}.
echo Log file is at $rman_backup_current.
else
echo Backup of the database succeeded.
echo Log file is at $rman_backup_current.
mail -s 'Oracle Backup Completed' you@yourdomain.com < /usr/lib/oracle/xe/oxe_backup_current.log

fi

#Wait for user to press any key
#echo -n "Press ENTER key to exit"
#read userinp