Run your Tomcat server on HTTPS

Simple Steps to make your TOMCAT Run on HTTPS using KEYTOOL utility

1). keytool -genkey -alias www.mytest.com -keyalg RSA -keysize 2048 -keystore www_mytest_com.jks

2). keytool -certreq -alias www.mytest.com -file www_mytest_com.csr -keystore www_mytest_com.jks

3). keytool -import -trustcacerts -alias www.mytest.com -file D:\www_mytest_com.p7b -keystore www_mytest_com.jks
This will install Certificate and the Root Certificate associated with the same., sometimes this will not work and in that case try the below steps.

3.1). keytool -import -alias www.mytest.com -file D:\www_mytest_com.cer -keystore www_mytest_com.jks
3.2). keytool -import -trustcacerts -file D:\www_mytest_com_root.cer -keystore www_mytest_com.jks

4). Modify server.xml and Restart TOMCAT SERVER


**Note: By default Tomcat will look for your Keystore with the file name .keystore in the home directory with the default password changeit. The home directory is generally /home/user_name/ on Unix and Linux systems, and C:\Documents and Settings\user_name\ on Microsoft Windows systems

Apache 2 to Tomcat Connector Using Proxy

The simplest configuration is described. It assumes you already have Tomcat 5.5 and Apache 2.0 (instructions for Apache 1.3 is also provided) installed and running.

The instructions are applicable (have been tested) for Windows as well as Linux platform.

Assume you want to map test directory of Apache to the mytest web application of Tomcat. Change the name appropriately to suit your configuration.

1. Shutdown Apache & Tomcat Server
2. Add the following lines to httpd.conf (in conf directory of Apache base directory)

LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
ProxyPass /test/ http://localhost:8081/mytest/
ProxyPassReverse /test/ http://localhost:8081/mytest/

Note 1: Replace localhost with the appropriate IP address or hostname of the server where Tomcat is installed.

Note 2: On older Apache 1.3 you will have to use libproxy.so instead:
LoadModule proxy_module modules/libproxy.so
AddModule mod_proxy.c

Tomcat Hardening Recomendations

1. use an unprivileged user account to run the  server.
2.use a firewall before your server
3. Disable the connectors you dont need  in server.xml
4. disable the tomcat's admin/manager web application completely or configure it that way that it needs proper username/passwort and connection from well known hosts
5. Disable the examples application
6. use apache http server to forward the request to the tomcat server.
7. bind tomcat to those IPs and ports only which you need, don't bind to any
8.Use server-minimal.xml instead of server.xml (make security life simpler;-)
9. check what you allow in tomcat's default context.xml, web.xml and anything below your configured host 10. use a special user to run tomcat, don't use administrator/root for that
11. allow only that user to read all your files, disallow any other users
12. make all files read-only (except those tomcat needs to write to)

To Allow/Disallow access from Specifc port use following Valves.
<Valve className="org.apache.catalina.valves.RemoteHostValve" allow="10.6.1.*" deny="10.6.1.1"/>

By Defining Address Tag we can Allow the AJP Access from specific IP only as shown below
<Connector address="127.0.0.1" port="8009"   enableLookups="false" redirectPort="8443" protocol="AJP/1.3"  allowTrace="false" xpoweredBy="true"/>

<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"  prefix="localhost_access_log." suffix=".txt" pattern="common" resolveHosts="false"/>
<Valve className="org.apache.catalina.valves.RemoteHostValve" allow="127.0.0.1,10.6.10.*" deny="10.6.10.2"/>

while Config of ADMIN/ Manager Application For tomcat Administration put admin.xml and manager.xml from the server's server\webapps location to the D:\ApacheSoftwareFoundation\Tomcat5.5\conf\Catalina\localhost and Restart the Tomcat Server to get the Changes
whenever making any change to the admin.xml again put the same in the above mentioned location and Restart

Always Allow ADMIN/Manager Application from Local/Intranet IP's don’t let them over Internet due to security Threat

For more informations on securing TOMCAT refere
http://www.owasp.org/index.php/Securing_tomcat
http://www.unidata.ucar.edu/Projects/THREDDS/tech/reference/TomcatSecurity.html