+14We have had some complaints about the non standard HTTPS port Tomcat uses. I know that to modify the port used I need to modify the server.xml file in the Tomcat directory. I am thinking I could change the port or try a redirect.
Has anyone attempted this? I am afraid client communications may be messed up if I change it.
Best answer by powellbc
Well, it looks like adding a second connector line to the server.xml did it. I just used the port as 443 and then specified the redirect port as 8443.
Ergo:
<Connector executor="tomcatThreadPool" port="443" protocol="HTTP/1.1" redirectPort="8443" scheme="https" secure="true" SSLEnabled="true" ><!--keystoreFile updated by JSS. Mon Aug 13 13:09:03 EDT 2012--><!--keystoreFile updated by JSS. Mon Mar 25 13:40:50 EDT 2013--></Connector>
I left out the file location and cipher info in this sample above.
+24Do a redirect for the web interface. You don't want to go changing the actual port that the client communicates on. It's also easier to roll back/change later than an endpoint configuration change like that.
+14That is the route I was going to take, but I am a little confused as to how to do that. We are running Tomcat/JSS on a Windows server, and most of the methods I have found are mentioning IPTables or assuming that Apache is running on the server as well.
+14Well, it looks like adding a second connector line to the server.xml did it. I just used the port as 443 and then specified the redirect port as 8443.
Ergo:
<Connector executor="tomcatThreadPool" port="443" protocol="HTTP/1.1" redirectPort="8443" scheme="https" secure="true" SSLEnabled="true" ><!--keystoreFile updated by JSS. Mon Aug 13 13:09:03 EDT 2012--><!--keystoreFile updated by JSS. Mon Mar 25 13:40:50 EDT 2013--></Connector>
I left out the file location and cipher info in this sample above.
+5I got this working in 9.8 by changing the TOMCAT7_USER and TOMCAT7_GROUP from tomcat7 to root in the /etc/init.d/jamf.tomcat7 script.
+3Instead of changing the user for tomcat to root, I changed the authbind settings to tomcat can us privileged ports under 1023.
Change contents of file /etc/authbind/byuid/105 (mine is a manual jss/tomcat config) to
::/0,443
0.0.0.0/0,443
Make sure your /etc/default/tomcat7 has AUTHBIND=YES commented out! On a linux box with JSS installed using the installer this path will be different!
+14This is still working for us, we did not encounter any issues post-upgrade to 9.8. We did upgrade from Java 6 to 8 though in the process, so that might have had an impact in some way. The Server.xml though is the same as it was before.
+1We are still using the additional connector--my previous comment was due to my own trivial error that I fixed the same day (can't remember what it was exactly).
I just had to renew our wildcard certs and it was a pain so I thought I'd take a few minutes to document the process from start to finish in case it will help others. These steps use a Windows 2012 R2 server to complete the certificate renewal process.
sorry Raymond, i have to go to attend another matter. Here is the original xml
+<Connector port="443" protocol="org.apache.coyote.http11.Http11Nio2Protocol" executor="tomcatThreadPool" URIEncoding="UTF-8" secure="true" scheme="https" SSLEnabled="true" server="Apache Tomcat" sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation" maxPostSize="-1">
<!-- Define an AJP 1.3 Connector on port 8009 -->
<Connector port="8009" redirectPort="443" protocol="AJP/1.3" URIEncoding="UTF-8"/>
<!-- An Engine represents the entry point (within Catalina) that processes every request. The Engine implementation for Tomcat stand alone analyzes the HTTP headers included with the request, and passes them on to the appropriate Host (virtual host). Documentation at /docs/config/engine.html -->
<!-- You should set jvmRoute to support load-balancing via AJP ie : <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1"> -->
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
