Apache Tomcat installation and configuration options on Documentation - V2

Configuring Apache Tomcat to use secure https protocol

Mon, 01 Jan 0001 00:00:00 +0000

Info

Summary: this page explains how to modify your Apache Tomcat application server to enable the use of the https protocol.

Introduction

When installed “out of the box”, the Apache Tomcat application server will be configured to use the “http” protocol on port 8080, as shown in the following extract from the CATALINA_HOME\conf\server.xml file:

 <!-- A "Connector" represents an endpoint by which requests are received
 and responses are returned. Documentation at :
 Java HTTP Connector: /docs/config/http.html (blocking & non-blocking)
 Java AJP Connector: /docs/config/ajp.html
 APR (HTTP/AJP) Connector: /docs/apr.html
 Define a non-SSL HTTP/1.1 Connector on port 8080
 -->

 <Connector port="8080" protocol="HTTP/1.1"
 connectionTimeout="20000"
 redirectPort="8443" />

 <!-- A "Connector" using the shared thread pool-->
 <!--
 <Connector executor="tomcatThreadPool"
 port="8080" protocol="HTTP/1.1"
 connectionTimeout="20000"
 redirectPort="8443" />
 -->

If your organization requires the use of the “https” protocol on port 443 (or another port) when interacting with the CAST dashboards, then there are various steps that need to be completed with regard to the Apache Tomcat installation. You can find out more information about the changes that are required by following the official Apache Tomcat documentation here: https://tomcat.apache.org/tomcat-8.5-doc/ssl-howto.html.

Disabling insecure HTTP methods in Apache Tomcat - webdav

Mon, 01 Jan 0001 00:00:00 +0000

Info

Summary: this page explains how to modify your Apache Tomcat application server (and other web applications) to disable insecure HTTP methods, such as webdav, to prevent modification of CAST dashboard pages.

Introduction

Some Apache Tomcat installations and/or web applications may be configured to use a servlet called org.apache.catalina.servlets.WebdavServlet (see https://tomcat.apache.org/tomcat-8.0-doc/api/org/apache/catalina/servlets/WebdavServlet.html) to provide webdav access to resources. Although this is a legitimate access method, if you prefer to ensure that no resources (i.e. pages) can be modified via webdav, you need to ensure that the servlet is disabled.

Disabling weak SSL cipher suites to improve security

Mon, 01 Jan 0001 00:00:00 +0000

Info

Summary: this page explains how to modify your Apache Tomcat web application server, Windows Operating System and Apache web server to disable weak SSL cipher suites to improve security when using the HTTPS protocol to access CAST web applications.

Introduction

As described in Configuring Apache Tomcat to use secure https protocol, it is possible to configure Tomcat for secure https access to the CAST dashboards. Apache recommends an SSL connector for you to use and by default this connector (whether APR or JSSE based) will include a list of Cipher Suites the client (i.e. the CAST web application) is permitted to negotiate in the SSL handshake phase. Unfortunately this list of Cipher Suites will include weak export grade ciphers that are insecure. As such CAST recommends actually specifying the Cipher Suites you wish to use, rather than relying on the default which includes many insecure ciphers that could pose a risk to your organization’s security.

Setting up a Reverse Proxy on Apache web server

Mon, 01 Jan 0001 00:00:00 +0000

Info

Summary: Here we have specified one of several approaches for configuring a reverse proxy for the CAST dashboards to hide the application server or to take advantage of some specific Apache configuration. This method assumes that you have installed Apache HTTP Server (available at http://httpd.apache.org/download). We recommend using version 2.4 (minimum) - 2.2 is NOT recommended.

The steps required to establish the reverse proxy are as follows. First, edit the httpd.conf file available in the Apache installation location e.g.: