Page History
...
| Note | ||||
|---|---|---|---|---|
| ||||
|
...
Install required (and used, throughout this documentation) packages, possibly replacing vim with your $EDITOR of choice (e.g. emacs-nox or nano, both of which also support syntax highlighting, which helps when editing XML files) and stop the automatically started tomcat until we've completed more configuration performed further below:
| No Format |
|---|
apt install --no-install-recommends default-jdk-headless tomcat9 \
vim less openssl unzip curl expat multitail gnupg net-tools
systemctl stop tomcat9 |
...
| Tip | ||||
|---|---|---|---|---|
| ||||
In case you're replacing an expiring TLS certificate where the matching private key is still considered to be secure and of sufficient strength (in 2021 2024 CE for RSA keys that means a key size of at least 2048 bits) you may want to keep using the existing private key (and PKCS#12 keystore passphrase) and generate the CSR from that key.
When asked to "Enter Import Password" supply the existing Then generate a CSR from the extracted private key, either by supplying the necessary data (at least the subject) on the command line or by entering any data interactively when being prompted for it (when not adding
When asked to "Enter pass phrase for webserver.key" again provide the passphrase from the previous steps. The content of webserver.csr is what you provide to your CA then, e.g. via |
...
By default Tomcat logs everything multiple times, including to /var/log/tomcat9/catalina.out and /var/log/tomcat9/localhost.$date.log*, which we don't care for. So create a backup copy of Tomcat's logging.properties and replace its content with the minumum needed to getTomcat's stdout/stderr to the console (which ends up in the systemd journal in our configuration). To prevent catalina.out from being created we deacticate it further below (in our "Systemd service" override) by setting the CATALINA_OUT=/dev/null environment variable for the Java java process.
| No Format |
|---|
systemctl stop tomcat9 cp -a /etc/tomcat9/logging.properties /etc/tomcat9/logging.properties.`date -u +%Y%m%d` echo -n 'handlers = java.util.logging.ConsoleHandler java.util.logging.ConsoleHandler.level = INFO java.util.logging.ConsoleHandler.formatter = org.apache.juli.SystemdFormatter org.apache.catalina.core.ContainerBase.[Catalina].[localhost].level = INFO org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = java.util.logging.ConsoleHandler ' > /etc/tomcat9/logging.properties |
...
| No Format |
|---|
rm -f /var/log/tomcat9/* systemctl restart tomcat9 ls -l /var/log/tomcat9/ multitail /var/log/tomcat9/* -l 'journalctl -u tomcat9.service -f' # exit with 'q' systemctl stop tomcat9 |
Since If you're certain there's no catalina.log file being generated anymore we you can also disable the default logrotate config snippet for it:
| No Format |
|---|
sed -i 's/^/#/' /etc/logrotate.d/tomcat9 |
Systemd service
Debian 10's Tomcat comes with an almost-usable systemd service that needs to be amended in order to
- avoid Avoid the systemd-house-of-horror that's still all too common with Tomcat packaging, and/Java packaging
- Avoid slow startup times due to use of a blocking /dev/random (cf. Myths about urandom also linked from the Shib wiki).
- Allow allow the IDP application to write logs and metadata to the filesystem as needed
- Try avoiding the creation of catalina.out (we already have its content in journald using this configuration)
And since we're creating an override for the system-supplied systemd service unit anyway we'll also set the maximum memory usage there ("-Xmx3g" in the example below, i.e., 3GB).
Adjust as needed, but 3-4GB should be sufficient even for large metadata aggregates (as are common with Interfederation). Also leave a bit of RAM for the OS. 
(Not that you should be running anything else on an IDP server.)
...
Overview
Content Tools
Tasks