My experience with SGI, Tomcat, and Apache, and IRIX 6.5
Disclaimer
I am Jan Labanowski (jkl@ccl.net) and what follows is my confession,
my deepest and darkest secrets... If you follow my footsteps you may
be doomed forever, so you agree to do it on your own, and do not sue
me, since you were warned.
Help me...
Please help me improve this document, correct errors, and just help.
I do not want you to suffer, like I did, so if you see something wrong,
just let me know. Please... Thanks...
The story...
This is a log of my of installation Apache/Tomcat DSO on some SGI machine
running IRIX:
% uname -a
IRIX64 voyager 6.5 01101245 IP27
which was not a first priority as maintenance is concerned.
I do not know IRIX at all, so your comments/corrections/improvements
to this document would be greatly appreciated. For me, the IRIX simply does not
work like it should (but it is probably my lack of experience) , and it seems
that open software community does not give a damn either, since many
packages just do not compile without a lot of massaging. For this reason,
I was using installation packages as much as I could.
This memo was originally written around Apr 17, 2001
The UNIX commands are in italic. It assumed that you will just grab them
with the mouse and paste them in your xterm...
Few terms:
Apache -- the Web Server
DSO -- Dynamic Shared Object (additional modules can be added/updated
to Apache without the need to recompile the whole thing, similar
to shared libraries, but DSO modules are not only called, but
can also call routines within Apache)
MM -- memory management or something like that - an add-on to Apache
and its modules to communicate via shared memory rather than files
(faster).
SSL -- Secure Socket Layer - the encryption and certificate package which
works with Apache
Tomcat -- the Java Server Pages (JSP) and Servlet container which uses the
Java Servlets spec 2.2, and the JSP spec 1.1.
It is still being actively developed and has some "features".
You may want to read my FAQ on Tomcat 3.1 beta 1. since it will be
easier to follow this installation log. It is available at:
http://www.ccl.net/cca/software/UNIX/apache/tomcat3.1b1-faq.html
Under This Link you will find copies of tardist
and tar.gz files which are retrieved for this installation, unless they
are copyrighted/something/crypto-munition, and I am not allowed to share them
with you. Just right click on them and do "Save As".
Getting Java JDK
The default shell for root was tcsh (again, I am not the sysadmin of this box).
I changed it to sh by typing
sh
.
default path for root was:
/usr/sbin:/usr/bsd:/sbin:/usr/bin:/etc:/usr/etc:/usr/bin/X11:/usr/express/bin/sg6
but there was a lot of strange links in /sbin and /usr/sbin like:
gcc was linked as /usr/sbin/gcc rather than /usr/bin/gcc,
or /usr/sbin/gunzip rather than /usr/bin/gunzip, etc...
The regular development software was linked within /usr/sbin and /sbin
directories for some reason).
I had to rearrange the path. My path was:
PATH=/usr/local/bin:/usr/freeware/bin:/usr/gnu/bin
PATH=${PATH}:/usr/bin:/usr/sbin:/usr/bsd:/sbin:/usr/bin/X11:
PATH=${PATH}:/usr/express/bin/sg6
export PATH
Then, I checked if I need Java:
showprods | grep java
Java 1.2 is fine, you do not have to have 1.3. If you do not have Java
you need to get it from SGI Web site. To get it, you need to register
(unless you already did). To register, you need your SGI box serial
number.
1) My machine was Onyx2. To get serial number, you need to do:
sysinfo -vv | cut -d" " -f2
which prints something like:
K0065abc
2) Go to a page: http://www.sgi.com/products/evaluation/6.x_java2_1.3/
You may need to register to SurfZone (there is a link there).
Click on Install at the bottom. Then you will be sent to another page
Where you will "ACCEPT" terms and conditions. On the next page
you can either save the distribution to install it later swmgr or
inst as I did (I right clicked on Install "java_eoe & java_dev"
and chose "Save link as:" in /tmp/6.x_java2_eoedev_1.3.tardist) or you
can just click with a left mouse button and swmgr will be called
automatically. Since I will be installing the thing on more machines
it is nice to have a tardist file around rather then download it
many times.
3) Install Java as:
mkdir /usr/freeware/java1.3
cd /usr/freeware/java1.3
mv /tmp/6.x_java2_eoedev_1.3.tardist .
tar xvf 6.x_java2_eoedev_1.3.tardist
inst
install *
go
quit
This should put the stuff in /usr/java (BTW, I hate the choice of location).
Of course you can change the location with "inst -r target", but then
your /var/inst is messed up. and does not know about it. It is convenient
to have different versions of Java around, but SGI does not know about it.
4) Install other stuff (SSL and CRYPTO):
I set the environment:
JAVA_HOME=/usr/java
export JAVA_HOME
PATH=${PATH}:${JAVA_HOME}/bin
export PATH
CLASSPATH=${JAVA_HOME}/lib/tools.jar:${JAVA_HOME}/lib/dt.jar
export CLASSPATH
Got jce-1_2_1.zip from SUN: http://www.javasoft.com/products/jce/
and placed it in /usr/local/JCE
cd /usr/local/JCE
unzip jce-1_2_1.zip
cp -p /usr/local/JCE/jce1.2.1/lib/*.jar ${JAVA_HOME}/jre/lib/ext
CLASSPATH=${CLASSPATH}:${JAVA_HOME}/jre/lib/ext/jce1_2_1.jar
export CLASSPATH
Then edited ${JAVA_HOME}/jre/lib/security/java.security and added a line:
security.provider.3=com.sun.crypto.provider.SunJCE
after similar lines which were there.
Got jsse-1_0_2-do.zip from SUN: http://java.sun.com/products/jsse/
and placed it in /usr/local/jsse.
cd /usr/local/jsse
unzip jsse-1_0_2-do.zip
cp -p /usr/local/jsse/jsse1.0.2/lib/*jar $JAVA_HOME/jre/lib/ext
CLASSPATH=${CLASSPATH}:${JAVA_HOME}/jre/lib/ext/jcert.jar
CLASSPATH=${CLASSPATH}:${JAVA_HOME}/jre/lib/ext/jnet.jar
CLASSPATH=${CLASSPATH}:${JAVA_HOME}/jre/lib/ext/jsse.jar
export CLASSPATH
and edited $JAVA_HOME/jre/lib/security/java.security and added a line:
security.provider.4=com.sun.net.ssl.internal.ssl.Provider
Installing important tools which I cannot live without...
Before you install anything, you check if you have it first, like
showprods | grep something
and if this is not showing anything, maybe it was not installed via
swmgr/inst and you need to check it with a plain:
which something
or
whereis something
Note... All things below assume that I am running sh, with the above
PATH as a root. If you log out, you need to come back here,
log in as root, type sh, and set the PATH. The PATH in your case may not need
to be so strange, but in my case it has to since otherwise I would be accessing
some old stuff installed on this machine ages ago, which simply does not work.
When I looked into the /usr/gnu/bin, the machine did not have basic
tools installed. i.e., no gmake, no gtar, etc...
I decided to place all the needed packages/executables in /usr/freeware
or in /usr/local/bin (this directory was not present on the machine).
The stuff which is compiled from source, I usually installed in /usr/local/xxx
while the freeware which was installed with "inst" was installed routinely
in /usr/freeware/bin, /usr/freeware/lib, /usr/freeware/include. So remember
look there for goodies. I also did not delete the distribution packages
or tar archives from the disk, since I may need them later, as I will be
installing this on another machine, and it is just easier to scp on local
network rather than download it from remote sites.
Installing wget
I started from downloading the wget from
ftp://ftp.cis.ohio-state.edu/mirror/gnu/wget/ and
then installed it like:
cd /usr/freeware/
mkdir wget
cd wget
ftp ftp.cis.ohio-state.edu
Name: anonymous
Login: jkl
cd mirror/gnu/wget
binary
get wget-1.6.tar.gz
quit
Then, I unpacked it the old fashioned way (there was no gtar on the machine):
cd /usr/freeware/wget
gunzip wget-1.6.tar.gz
tar xvf wget-1.6.tar
Then I built the wget (a command line web retrieval utility) as:
cd /usr/freeware/wget/wget-1.6
./configure
make
make install
which installed wget in /usr/local/bin and also created /usr/local/etc
Installing Gnu Tar
From the ftp://ftp.cis.ohio-state.edu/mirror/gnu/" (but you may
find closer mirror from http://www.gnu.org)
I retrieved tar-1.13.tar.gz. Then I installed it as:
mkdir /usr/freeware/gtar
cd /usr/freeware/gtar
gunzip tar-1.13.tar.gz
tar xvf tar-1.13.tar
cd tar-1.13
./configure
make
make check
make install
which put it in /usr/local/bin.
Installing gmake
Then I installed gmake:
mkdir /usr/freeware/gmake
cd /usr/freeware/gmake
wget ftp://ftp.cis.ohio-state.edu/mirror/gnu/make/make-3.79.1.tar.gz
tar zxvf make-3.79.1.tar.gz # note, the GNU tar is in my path now
cd make-3.79.1
./configure
make
make check
make install
which installed make to /usr/local/bin.
Installing unzip
Then I installed unzip
mkdir /usr/freeware/unzip
cd /usr/freeware/unzip
wget http://freeware.sgi.com/Dist/fw_unzip-5.40.tardist
tar xvf fw_unzip-5.40.tardist
inst -f .
instal *
go
quit
Installing emacs
Then I installed emacs, since this is my editor of choice.
I went to http://freeware.sgi.com/index-by-alpha.html and
retrieved it:
mkdir /usr/freeware/emacs
cd /usr/freeware/emacs
wget http://freeware.sgi.com/Dist/fw_xemacs-21.1.10.tardist
tar xvf fw_xemacs-21.1.10.tardist
inst -f .
go
But it barked at me:
fw_xemacs.xemacs.eoe cannot be installed because of missing prerequisites:
1a. Do not install fw_xemacs.xemacs.eoe (1236615220)
1b. Also install fw_gdbm.sw.lib (1236359920 - 1239999900),
fw_libjpeg.sw.lib (1235274920 - 1239999900), fw_libpng.sw.lib
(1236359820 - 1239999900), fw_libxpm.sw.lib (1235275020 -
1239999900), fw_libz.sw.lib (1235723320 - 1239999900) and
fw_tiff.sw.lib (1235509620 - 1239999900) from an additional
distribution -- insert another CD or specify another software
distribution.
so I installed needed pieces:
gdbm -- gnu UNIX database
mkdir /usr/freeware/gdbm
cd /usr/freeware/gdbm
wget http://freeware.sgi.com/Dist/fw_gdbm-1.8.0.tardist
tar xvf fw_gdbm-1.8.0.tardist
inst -f .
go
quit
libjpeg -- library for JPEGs
mkdir /usr/freeware/libjpeg
cd /usr/freeware/libjpeg
wget http://freeware.sgi.com/Dist/fw_libjpeg-6b.tardist
tar xvf fw_libjpeg-6b.tardist
inst -f .
go
quit
libxpm -- xpm images library
mkdir /usr/freeware/libxpm
cd /usr/freeware/libxpm
wget http://freeware.sgi.com/Dist/fw_libxpm-3.4k.tardist
tar xvf fw_libxpm-3.4k.tardist
inst -f .
go
quit
libz -- compression library
mkdir /usr/freeware/libz
cd /usr/freeware/libz
wget http://freeware.sgi.com/Dist/fw_libz-1.1.3.tardist
tar xvf fw_libz-1.1.3.tardist
inst -f .
go
quit
tiffutils -- TIFF image library
mkdir /usr/freeware/tiffutils
cd /usr/freeware/tiffutils
wget http://freeware.sgi.com/Dist/fw_tiff-v3.4beta037.tardist
tar xvf fw_tiff-v3.4beta037.tardist
inst -f .
go
quit
libpng -- png image library
mkdir /usr/freeware/libpng
cd /usr/freeware/libpng
wget http://freeware.sgi.com/Dist/fw_libpng-1.0.6.tardist
tar xvf fw_libpng-1.0.6.tardist
inst -f .
go
quit
and then tried again to install emacs
cd /usr/freeware/emacs
inst -f .
go
quit
mkdir /usr/freeware/gnu-emacs
cd /usr/freeware/gnu-emacs
wget http://freeware.sgi.com/Dist/fw_gnu-emacs-20.7.tardist
tar xvf fw_gnu-emacs-20.7.tardist
inst -f .
go
quit
Installing SSH -- secure shell
I tried to install binary distribution of OpenSSH from
http://freeware.sgi.com/Dist/fw_openssh-2.3.0p1.tardist
but it needed many libraries... Since this is academic site,
I could use the original ssh (if you are commercial, you cannot use it,
I believe, without paying).
cd /usr/freeware
mkdir ssh
cd /usr/freeware/ssh
wget ftp://ftp.sbs.de/pub/security/ssh/ssh-1.2.31.tar.gz
tar zxvf ssh-1.2.31.tar.gz
cd ssh-1.2.31
./configure
make
make install
It installs the ssh in /usr/local/bin, and sshd in /usr/local/sbin.
Then installed script run-sshd in /etc/init.d to make sshd (SSH demon)
start up at boot. To make it start sshd server daemon on boot, I linked
the script in /etc/rc2.d
cd /etc/init.d
chmod 755 run-sshd
cd /etc/rc2.d
ln -s ../init.d/run-sshd S98run-sshd
Installed latest zlib (compression routines)
mkdir /usr/freeware/zlib
cd /usr/freeware/zlib
wget ftp://ftp.info-zip.org/pub/infozip/zlib/zlib.tar.gz
tar zxvf zlib.tar.gz
cd zlib-1.1.3
./configure
make
make test
make install
It installs libz in /usr/local/lib
Installed newer gcc
Installed new 2.95 gcc, since the current is old (2.8.1)
gcc --version
told me: 2.8.1
mkdir /usr/freeware/gcc
cd /usr/freeware/gcc
wget http://freeware.sgi.com/Dist/fw_gcc-2.95.2-sgipl1.tardist
tar xvf fw_gcc-2.95.2-sgipl1.tardist
inst -f .
go
Installed new openssl
OpenSSL (www.openssl.org) contains all needed routines to do SSL secure
sockets.
mkdir /usr/freeware/openssl
cd /usr/freeware/openssl
wget http://freeware.sgi.com/Dist/fw_openssl-0.9.6.tardist
tar xvf fw_openssl-0.9.6.tardist
inst -f .
go
quit
It installed them in /usr/freeware/lib, /usr/freeware/bin,
/usr/freeware/include/openssl
Upgrading perl
The perl was old (5.004_04) so I got the newer one.
mkdir /usr/freeware/perl
cd /usr/freeware/perl
wget http://freeware.sgi.com/Dist/fw_perl-5.005_03.tardist
tar xvf fw_perl-5.005_03.tardist
inst -f .
go
quit
Installing Apache
I tried to install the latest stable Apache (1.3.19) from sources, but
it did not work. I was getting the error:
gcc -I/usr/freeware/apache-1.3.19/mm-1.1.3 -I./os/unix -I./include \
-DIRIX -DMOD_SSL=208102 -DUSE_HSREGEX -DEAPI -DEAPI_MM -DUSE_EXPAT \
-I./lib/expat-lite -fpic -DSHARED_CORE `./apaci` \
-L/usr/freeware/apache-1.3.19/mm-1.1.3/.libs \
-o libhttpd.ep -DSHARED_CORE_TIESTATIC main/http_main.c \
-L. -lhttpd -lmm
ld32: WARNING 84 : ./libhttpd.so is not used for resolving any symbol.
ld32: ERROR 33 : Unresolved text symbol "ap_main" -- 1st referenced by /var/tmp/ccBRwCce.o.
Use linker option -v to see when and which objects, archives and dsos are loaded.
ld32: ERROR 33 : Unresolved text symbol "ap_validate_password" -- 1st referenced by /var/tmp/ccBRwCce.o.
Use linker option -v to see when and which objects, archives and dsos are loaded.
ld32: ERROR 33 : Unresolved text symbol "XML_ErrorString" -- 1st referenced by /var/tmp/ccBRwCce.o.
Use linker option -v to see when and which objects, archives and dsos are loaded.
ld32: INFO 152: Output file removed because of error.
collect2: ld returned 2 exit status
make[2]: *** [libhttpd.ep] Error 1
make[2]: Leaving directory `/usr/freeware/apache-1.3.19/apache_1.3.19/src'
make[1]: *** [build-std] Error 2
make[1]: Leaving directory `/usr/freeware/apache-1.3.19/apache_1.3.19'
make: *** [build] Error 2
I pretty much have an idea what is the problem (the #define for IRIX is
probably missing), but I did not have time to chase this. It seems like
Apache team no longer supports IRIX 6.5, which is probably sensible
in view of latest SGI directions. I removed previous installation of
Apache.
inst
remove fw_apache
go
quit
and then installed 1.3.14 from freeware site:
mkdir /usr/freeware/apache-1.3.14
cd /usr/freeware/apache-1.3.14
wget http://freeware.sgi.com/Dist/fw_apache-1.3.14.tardist
tar xvf fw_apache-1.3.14.tardist
inst -f .
install * # or step and chose all "i" for install)
go
quit
This installed apache to /usr/freeware/apache. The directories are
bin -- auxiliary programs: dbmmanage, htdigest, htpasswd
etc -- config files and SSL certificates
include -- the include files for apache if you want to compile additional
modules
libexec -- where the DSO modules are
sbin -- apache binary, apxs script, and startup script apachectl
share -- the web contents
var -- log, cache files, pid file, etc.
Installing Tomcat 3.2.1
I downloaded needed binaries and sources of tomcat:
mkdir /usr/freeware/jakarta-tomcat
cd /usr/freeware/jakarta-tomcat
wget http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.2.1/bin/jakarta-servletapi-3.2.tar.gz
wget http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.2.1/bin/jakarta-tomcat-3.2.1.tar.gz
tar zxvf jakarta-servletapi-3.2.tar.gz
tar zxvf jakarta-tomcat-3.2.1.tar.gz
wget http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.2.1/src/jakarta-tomcat-3.2.1-src.tar.gz
tar zxvf jakarta-tomcat-3.2.1-src.tar.gz
Then I edited jk_pool.h and added IRIX #define.
cd /usr/freeware/jakarta-tomcat/jakarta-tomcat-3.2.1-src/src/native/jk
edited jk_pool.h and and added around line 92
#elif defined(IRIX)
typedef long long jk_pool_atom_t;
Then I compiled mod_jk module for Apache:
cd /usr/freeware/jakarta-tomcat/jakarta-tomcat-3.2.1-src/src/native/apache1.3
JAVA_HOME=/usr/java
export JAVA_HOME
/usr/freeware/apache/sbin/apxs -o mod_jk.so -DIRIX -I../jk \
-I${JAVA_HOME}/include -I${JAVA_HOME}/include/irix -c *.c ../jk/*.c
cp mod_jk.so /usr/freeware/apache/libexec
cd /usr/freeware/jakarta-tomcat
Created a small file called my_env and made it executable:
chmod 755 my_env
Whenever I wanted to refresh my environment (e.g., after logging out), I ran
. my_env
Then I had to change server.xml for tomcat, since default apache came
with port 8080 and I would have port conflict.
cd $TOMCAT_HOME
cd conf
mkdir orig
cp -p * orig
Edited server.xml and changed port 8080 to 7080 in HTTP connector
Then I started tomcat standalone
cd $TOMCAT_HOME/bin
startup.sh
I checked if the URL:
http://my.machine.edu:7080
works and executed few examples. It worked...
But this is not the way to do it, to execute tomcat as root!!! So I did
cd $TOMCAT_HOME/bin
shutdown.sh
Now... The tomcat should be some innocuous user which cannot do much
harm. But the Tomcat needs a shell, and cannot be a nobody.
I created user tomcat with uid and gid 60002
In /etc/group:
tomcat:*:60002:
and in /etc/passwd
tomcat:x:60002:60002:SVR4 tomcat uid:/usr/people/tomcat:/bin/sh
Then I also added tomcat to /etc/shadow file and set the password with
passwd tomcat
Then, I created home directory for tomcat user:
mkdir /usr/people/tomcat
chown tomcat /usr/people/tomcat
chgrp tomcat /usr/people/tomcat
Then, I changed ownership tomcat stuff to tomcat
cd $TOMCAT_HOME
chown -R tomcat .
chgrp -R tomcat .
and in /usr/people/tomcat I placed the my_env file from above as:
.profile:
cp $JAKARTA_HOME/my_env /usr/people/tomcat/.profile
chown tomcat /usr/people/tomcat/.profile
chgrp tomcat /usr/people/tomcat/.profile
Then, I became tomcat and check if it starts OK under new identity:
su - tomcat
cd $TOMCAT_HOME/bin
./startup.sh
It actually did.
Configuring the Apache/Tomcat ZOO...
Rather than giving you the step by step history of my editing files,
I will just include the final versions of the configuration files.
Before I actually messed with the files, I saved the originals:
cd $TOMCAT_HOME/conf
mkdir orig
cp -p * orig
cd /usr/freeware/apache/etc
tar zxvf ../etc-orig.tgz .
My config files are given here:
$TOMCAT_HOME/conf/mod_jk.conf
$TOMCAT_HOME/conf/workers.properties
$TOMCAT_HOME/conf/server.xml
$TOMCAT_HOME/bin/startup.sh
$TOMCAT_HOME/bin/tomcat.sh
$TOMCAT_HOME/bin/shutdown.sh
$TOMCAT_HOME/bin/jspc.sh
/usr/freeware/apache/etc/httpd.conf
Note that mod_jk.conf has the Tomcat contexts protected by id/password
with Apache Basic Authentication (look up the /examples for example).
To be able to access the servlets/JSPs you need to create two files:
/usr/freeware/apache/etc/htpasswd and /usr/freeware/apache/etc/htgroup
You need to read about it, but for testing you can get away with
files which contain one line:
/usr/freeware/apache/etc/htpasswd contains a line:
guest:abvyhtC1vX8PI
and /usr/freeware/apache/etc/htgroup contains a line:
demo: guest
The abvyhtC1vX8PI is encrypted guest, i.e., to log in you enter guest
for User Id and Password.
I tried if things work by starting first the tomcat (as user tomcat, not
a root!!!), and the apache as user root.
# I am root
su - tomcat
# I am tomcat
$TOMCAT_HOME/bin/startup.sh
exit
# I am root again
/usr/freeware/apache/sbin/apachectl startssl
I tried my URLs
http:/my.machine.edu:8080/examples # tomcat stuff seen via apache HTTP
https:/my.machine.edu/examples # tomcat stuff seen via apache with HTTPS
http:/my.machine.edu:7080/examples # tomcat stuff seen directly HTTP
It worked, so I took the stuff down as:
# I am root
/usr/freeware/apache/sbin/apachectl stop
su - tomcat
# I am tomcat
$TOMCAT_HOME/bin/shutdown.sh
exit
# I am root again
Creating Certificates
To have a real certificate, go to one of the Certificate Authorities,
read their web site, pay them money, and you will have known.
Just to create home made, self signed certificates, I used the following
procedure.
Created a /usr/freeware/apache/etc/Makefile.
It uses openssl and some tricks to create selfsigned certificate for the
Apache Web Server. Then I used the file to create certificates as follows
(if make does not work for you, use gmake):
RANDFILE=/var/adm/SYSLOG
export RANDFILE
cd /usr/freeware/apache/etc
mdkir certificates-01.04.17:20:20
mv ssl* certificates-01.04.17:20:20
mkdir ssl.key
mkdir ssl.csr
mkdir ssl.crt
make genkey # will ask you for password
# Then, you will need to "unpassword" the keys
# or you would have problems to start apache at boot time (it would
# ask for the password)
openssl rsa -in ssl.key/server.key -out ssl.key/server.key.unsecure
cp ssl.key/server.key.unsecure ssl.key/server.key
make certreq # make certificate request
make testcert # make selfsigned test certificate
I have a screen dump here.
For new certificates to take effect you need to restart Apache.
Tools to start/stop apache/tomcat combination
I created the apache-tomcat script which
starts both Apache and Tomcat. It expects that there is user tomcat, and
that the tomcat.sh script (called by the startup.sh script) writes
a file which contains the PID (process Id number) of the tomcat process.
The tomcat.sh script takes it from the $! shell variable and dumps it to
the file. You need to edit the script and modify file locations, etc.
to suit your particular needs. You now can start the Apache Tomcat
combination by logging as root and:
cd /usr/freeware/apache/sbin
./apache-tomcat start
and stop them by:
cd /usr/freeware/apache/sbin
./apache-tomcat stop
Note... The apache-tomact script also redirects all stderr and stdout
to the file $TOMCAT_HOME/logs/t3.2_jk.. This is where you will see
all your debug output JSP when you do:
System.out.println("myvar value is "+myvar);
or
System.err.println("myvar value is "+myvar);
in your servlets or JSPs. When something does not work, always look at:
$TOMCAT_HOME/logs/t3.2_jk
which in our case is:
/usr/freeware/jakarta-tomcat/jakarta-tomcat-3.2.1/logs/t3.2_jk
Now, the problem with setup is that you have to be a root to start/stop
apache/tomcat combination. To make it possible to start/stop apache/tomcat
by people without the need for logging as root, I created a setuid wrappers
for the apache-tomcat script, apache_start.c and apache_stop.c,
respectively. You need to compile them:
gcc -o apache_start apache_start.c
gcc -o apache_stop apache_stop.c
which will result in two executables: apache_start and apache_stop to
be created. Now, typing:
./apache_start
to start apache/tomcat is equivalent to typing:
./apache-tomcat start
Similarly, entering
./apache_stop
will stop apache/tomcat the same way the:
./apache-tomcat stop
does. You still need to be a root to execute these wrapper commands.
But you can make them to execute as root by changing their ownership to root
and setting their SUID bit even when they were executed by a regular user.
chown root apache_start apache_stop
chgrp root apache_start apache_stop
chmod ug+s apache_start apache_stop
Now, any mortal (i.e., anyone who can log in to the machine, i.e., the
"regular user") can start or stop the apache/tomcat combination by
executing /usr/freeware/apache/sbin/apache_start and
/usr/freeware/apache/sbin/apache_stop commands, respectively.
But maybe you do not want it? Maybe you want only a select group of
people to execute these commands? There are many ways to do it.
One, would be to modify the wrappers, to check if the user who
starts them belongs to a specific group or is on the list.
I used a simpler way. I put these commands in a special directory, which
is only accessible by root and group "tomcat". I also added the chosen
few to the group tomcat in the file /etc/group. The line there was:
tomcat:*:60002:tomcat,kenf,jkl
i.e., the group consists of users tomcat, kenf, and jkl. Then I made the
following things:
cd /usr/freeware/apache/sbin
mkdir up-down
chown root up-down
chgrp tomcat up-down
chmod 750 up-down
mv apache_start apache_stop up-down
Now, when you are a chosen one, you start apache/tomcat by executing:
/usr/freeware/apache/sbin/up-down/apache_start
and stop apache/tomcat by executing
/usr/freeware/apache/sbin/up-down/apache_stop
Now, to save typing, you can make the links in directories which are
always in the PATH, say:
cd /usr/bin
ln -s /usr/freeware/apache/sbin/up-down/apache_stop apache_stop
ln -s /usr/freeware/apache/sbin/up-down/apache_start apache_start
and then, the authorized people will be able to start and stop apache with:
apache_start
apache_stop
If you are not a member of group tomcat, you will not be allowed to access
anything under the up-down directory and it will bark:
/usr/freeware/apache/sbin/up-down/apache_stop - Permission denied
To make sure that things run hapilly, you can always do:
ps -ef | egrep 'httpd|tomcat'
To make it easier for people, I actually added a status option to
the apache-tomcat. I also created a wrapper around it apache_status.c
and compiled, and moved it to the up-down directory as described above for
the others, with a difference that it does not need to be SUID:
cd /usr/freeware/apache/sbin
gcc -o apache_status apache_status.c
mv apache_status up-down
cd /usr/bin
ln -s /usr/freeware/apache/sbin/up-down/apache_status apache_status
So now to check if Apache and Tomcat is running, you can do:
/usr/freeware/apache/sbin/apache-tomcat status
or, if you are a chosen one among the group tomcat (or a root):
apache_status
Now, you need to make these things start at boot time. This will make it.
case 1)
ls -l /etc/init.d/apache
tells you that there is apache startup/shutdown script in init.d. You do:
cd /etc/init.d
mv apache apache-freeware-original
cp /usr/freeware/apache/sbin/apache-tomcat apache
case 2)
There is no /etc/init.d/apache file. You need to make also links:
cd /etc/init.d
cp /usr/freeware/apache/sbin/apache-tomcat apache
cd /etc/rc2.d
ln -s ../apache S90apache
Now, the appeals to those of you who got to the end. Please help me
keep this useful. Please send comments, and especially bug reports,
or corrections to: jkl@ccl.net . Thanks...