0

How can I open a port and directly access a webapp running on tomcat on CentOS 7? Tomcat is running behind an apache httpd reverse proxy, but I want to directly access the apps running in tomcat by opening a port to directly expose each app for testing purposes.

When I open up ports 8080 and 8081 in firewalld using firewall-cmd --add-port=8080/tcp and firewall-cmd --add-port=8081/tcp, I am able to access the apps running on those ports when I type server.ip.addr:8080 or server.ip.addr:8081, or anydomainontheserver.com:8080 or anydomainontheserver.com:8081. Those apps are also accessible when I access them through httpd.

However, when I try to access the apps running on ports 8082, 8083, and 8084 directly, I get 404 errors in reply. This is the case even though the apps running on ports 8082 and 8083 are 100% accessible through httpd via their domain names. And the app running on port 8084 is mostly accessible via httpd via its domain name. In each case, I typed in firewall-cmd --add-port=808x and tried to access the apps via server.ip.addr:808x and anydomainontheserver.com:808x, but got 404 errors in each case. I even tried opening ports for their ajp ports in firewalld and typing server.ip.addr:80xx and anydomainontheserver.com:80xx in the browser but was given a browser error message that said the pages could not be retrieved without specifying the error number.

So how can I access the apps running on ports 8082, 8083, and 8084 directly through tomcat for testing purposes?

Typing firewall-cmd --list-all gives:

public (default, active)
  interfaces: enp3s0
  sources: 
  services: dhcpv6-client http imaps openvpn smtp ssh
  ports: 8009/tcp 8083/tcp 8011/tcp 8084/tcp 8010/tcp 8080/tcp 8081/tcp 8013/tcp 8012/tcp 8082/tcp
  masquerade: yes
  forward-ports: 
  icmp-blocks: 
  rich rules:

Typing nano /etc/httpd/conf.d/virtualhosts.conf gives:

<VirtualHost *:443>
    ServerName www.vpndomain.com
    ServerAlias vpndomain.com
    ErrorLog /var/log/httpd/vpndomain_com_error.log
    CustomLog /var/log/httpd/vpndomain_com_requests.log combined
    SSLEngine on
    SSLProxyEngine on
    SSLCertificateFile /etc/pki/tls/certs/localhost.crt
    SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
    ProxyPass / ajp://server.ip.addr:8009/
    ProxyPassReverse / ajp://server.ip.addr:8009/
</VirtualHost>

Listen 444

<VirtualHost *:444>
    ServerName www.vpndomain.com
    ServerAlias vpndomain.com
    ErrorLog /var/log/httpd/vpndomain_com_error.log
    CustomLog /var/log/httpd/vpndomain_com_requests.log combined
    SSLEngine on
    SSLProxyEngine on
    SSLCertificateFile /etc/pki/tls/certs/localhost.crt
    SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
    ProxyPass / ajp://server.ip.addr:8010/
    ProxyPassReverse / ajp://server.ip.addr:8010/
</VirtualHost>

<VirtualHost www.domain1.com:80>
    ServerName www.domain1.com
    ServerAlias domain1.com
    ErrorLog /var/log/httpd/domain1_com_error.log
    CustomLog /var/log/httpd/domain1_com_requests.log combined
    ProxyPass / ajp://server.ip.addr:8011/
    ProxyPassReverse / ajp://server.ip.addr:8011/
</VirtualHost>

<VirtualHost www.domain2.com:80>
    ServerName www.domain2.com
    ServerAlias domain2.com
    ErrorLog /var/log/httpd/domain2_com_error.log
    CustomLog /var/log/httpd/domain2_com_requests.log combined
    ProxyPass / ajp://server.ip.addr:8012/
    ProxyPassReverse / ajp://server.ip.addr:8012/
</VirtualHost>

<VirtualHost www.domain3.com:80>
    ServerName www.domain3.com
    ServerAlias domain3.com
    ErrorLog /var/log/httpd/domain3_com_error.log
    CustomLog /var/log/httpd/domain3_com_requests.log combined
    ProxyPass / ajp://server.ip.addr:8013
    ProxyPassReverse / ajp://server.ip.addr:8013
</VirtualHost>

And typing `nano /opt/tomcat/conf/server.xml gives:

<?xml version='1.0' encoding='utf-8'?>

<Server port="8005" shutdown="SHUTDOWN">
  <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
  <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
  <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />

  <GlobalNamingResources>
    <Resource name="UserDatabase" auth="Container"
              type="org.apache.catalina.UserDatabase"
              description="User database that can be updated and saved"
              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
              pathname="conf/tomcat-users.xml" />
  </GlobalNamingResources>

  <Service name="Catalina">
    <Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8443" />
    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
    <Engine name="Catalina" defaultHost="localhost">
          <Realm className="org.apache.catalina.realm.LockOutRealm">
              <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>
          </Realm>
          <Host name="localhost"  appBase="webapps" unpackWARs="true" autoDeploy="true">
               <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
                   prefix="ermapp_access_log" suffix=".txt"
                   pattern="%h %l %u %t &quot;%r&quot; %s %b" />
          </Host>
    </Engine>
  </Service>

  <Service name="Upload">
    <Connector port="8081" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8444" />
    <Connector port="8010" protocol="AJP/1.3" redirectPort="8444" />
    <Engine name="Catalina" defaultHost="localhost">
      <Realm className="org.apache.catalina.realm.LockOutRealm">
        <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>
      </Realm>

      <Host name="localhost"  appBase="webapps_upload" unpackWARs="true" autoDeploy="true">
        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
               prefix="uploadapp_access_log" suffix=".txt"
               pattern="%h %l %u %t &quot;%r&quot; %s %b" />
      </Host>
    </Engine>
  </Service>

  <Service name="Public">
      <Connector port="8082" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8445" />
      <Connector port="8011" protocol="AJP/1.3" redirectPort="8445" />
      <Engine name="Catalina" defaultHost="localhost">
          <Realm className="org.apache.catalina.realm.LockOutRealm">
              <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>
          </Realm>
          <Host name="domain1.com"  appBase="webapps_public" unpackWARs="true" autoDeploy="true">
              <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
                  prefix="domain1_access_log" suffix=".txt"
                  pattern="%h %l %u %t &quot;%r&quot; %s %b" />
          </Host>
      </Engine>
  </Service>

  <Service name="domain2">
      <Connector port="8083" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8446" />
      <Connector port="8012" protocol="AJP/1.3" redirectPort="8446" />
      <Engine name="Catalina" defaultHost="localhost">
          <Realm className="org.apache.catalina.realm.LockOutRealm">
              <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>
          </Realm>
          <Host name="domain2.com"  appBase="webapps_domain2" unpackWARs="true" autoDeploy="true">
              <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
                  prefix="domain2_access_log" suffix=".txt"
                  pattern="%h %l %u %t &quot;%r&quot; %s %b" />
          </Host>
      </Engine>
  </Service>

  <Service name="domain3">
      <Connector port="8084" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8447" />
      <Connector port="8013" protocol="AJP/1.3" redirectPort="8447" />
      <Engine name="Catalina" defaultHost="localhost">
          <Realm className="org.apache.catalina.realm.LockOutRealm">
              <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>
          </Realm>
          <Host name="domain3.com"  appBase="webapps_domain3" unpackWARs="true" autoDeploy="true">
              <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
                  prefix="domain3_access_log" suffix=".txt"
                  pattern="%h %l %u %t &quot;%r&quot; %s %b" />
          </Host>
      </Engine>
  </Service>

</Server>
  • Error 404 means the application is accessible but the requested file is not found. – Vinz Nov 3 '15 at 18:52
  • @Vinz Each app is a war file that is being served up through httpd. So the file is present. The problem is that the calls through ports 8082, 8083, and 8084 are not finding the files that httpd is finding. So how do we use your insights to further isolate the problem? – CodeMed Nov 3 '15 at 18:55
  • @Vinz Also, I just confirmed that, in each case, the war file is named ROOT.war and is located in its own directory, such that each tomcat service gets its own ROOT.war pulled up by httpd. – CodeMed Nov 3 '15 at 19:03
  • Error 404 is an HTTP error, so the file not found is a ressource in your application, not always a file on the filesystem. – Vinz Nov 3 '15 at 19:06
  • @Vinz Thank you. yes, I get that. But yet, somehow httpd is able to find the file from tomcat, while the direct firewalld bypass to tomcat is not able to find the file. – CodeMed Nov 3 '15 at 19:21
0

Your httpd proxy is using the AJP ports but when you try to access them directly you're using the HTTP ports.

If you try switching the httpd proxy to use the HTTP port does it still work or do you get the 404?

  • If you get the 404 through httpd when the proxy is using HTTP then there's a problem in your HTTP connector in Tomcat.

  • If it still works through httpd when the proxy is using the HTTP port then the problem is probably internal to the app itself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.