Page History

...

• In /etc/httpd/conf/httpd.conf, set ServerName:

  No Format
  ServerName idp.mit.edu:80

  and set the UseCanonicalName option to On:

  No Format
  UseCanonicalName On

• In /etc/httpd/conf.d/ssl.conf, set the SSLRandomSeed options:

  No Format
  SSLRandomSeed startup file:/dev/urandom 1024 SSLRandomSeed connect file:/dev/urandom 1024

  set the ServerName:

  No Format
  ServerName idp.mit.edu:443

  set the SSL cipher suite:

  No Format
  SSLCipherSuite HIGH:MEDIUM:EXP:!aNULL:!SSLv2:+SHA1:+MD5:+HIGH:+MEDIUM:+EXP

  set the server certificate, key, and CA paths:

  No Format
  SSLCertificateFile /etc/pki/tls/certs/idp-staging.mit.edu-cert.pem SSLCertificateKeyFile /etc/pki/tls/private/idp-staging.mit.edu-key.pem SSLCertificateChainFile /etc/pki/tls/certs/EquifaxCA.pem SSLCACertificateFile /etc/pki/tls/certs/mitCAclient.pem

  set the SSL options:

  No Format
  SSLOptions +StrictRequire

  configure custom logging:

  No Format
  CustomLog logs/ssl_request_log \ "%t %h %{HTTPS}x %{SSL_PROTOCOL}x %{SSL_CIPHER}x %{SSL_CIPHER_USEKEYSIZE}x %{SSL_CLIENT_VERIFY}x \"%r\" %b"

Install Tomcat

• Download current Tomcat 6.0 binary distribution (tested with 6.0.20, available in /mit/touchstone/downloads/apache-tomcat-6.0.20.tar.gz.
• cd /usr/local
• tar xzf /path/to/apache-tomcat-6.0.20.tar.gz
• rm -f tomcat
• ln -s apache-tomcat-6.0.20.tar.gz tomcat
• Create the tomcat user, and change the ownership of the tomcat tree:

  No Format
  # groupadd -g 52 tomcat # useradd -u 52 -g tomcat -c "Tomcat User" -d /usr/local/tomcat tomcat # chown -R tomcat:tomcat /usr/local/apache-tomcat-6.0.20