Jboss-HTTPS-Integration

JBOSS-HTTPS-Integration (at Muthoot Group )

Purpose

We have to ensure that access to the HRMS / ERP portal (JBOSS based Applications) is secure and based of standard mechanism with HTTPS / SSL access.

Objective

Move JBOSS access to SSL based access and that too on direct URL like https://Hostname/

and

Not on like http://hostname:port/ which is currently used .

Method

Mod_JK is used to integrate Apache with JBOSS

Referance document

http://www.jaysonjc.com/programming/configuring-apache-in-front-of-jboss-application-server-using-mod_jk.html

Download

Download for mod_jk for Centos / RHEL 5-32bit http://ftp-hk.tmapy.cz/tmapy-twist/centos/5/updates/i386/RPMS/mod_jk-ap20-1.2.28-2.el5.i386.rpm

Download for mod_jk for Centos / RHEL 6-64bit http://ftp.tmapy.cz/tmapy-twist/centos/5/updates/x86_64/RPMS/mod_jk-ap20-1.2.28-2.el5.x86_64.rpm

Test Bed

Local Server - 192.168.1.215

Assumptions

The Actual URL is http://Servername-IP:port/ and is not in form of http://Servername-IP:port/app1

Process

1. Make Sure you have ssl for apache installed i.e yum install mod_ssl

2. Install mod_jk-ap20 , by downloading from http://ftp-hk.tmapy.cz/tmapy-twist/centos/5/updates/i386/RPMS/mod_jk-ap20-1.2.28-2.el5.i386.rpm and installaing via rpm -Uvh

3. check for file mod_jk.so in /etc/httpd/modules/

4. Add in /etc/httpd/conf/httpd.conf

<VirtualHost *:80>
ServerName www.muthootonline.in
ServerAlias muthootonline.in
RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</VirtualHost>

5. Add following line at the top of /etc/httpd/conf.d/ssl.conf

LoadModule jk_module modules/mod_jk.so
JkWorkersFile conf/workers.properties 
JkShmFile logs/mod_jk.shm 
JkLogFile logs/mod_jk.log 

6 . Add following line after <VirtualHost _default_:443>

JkLogLevel info 
JkMount /* worker1 

Modify the Line below

SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
SSLCertificateFile /etc/httpd/conf/ssl/Muthootonline.in.crt
SSLCertificateKeyFile /etc/httpd/conf/ssl/server.key
SSLCertificateChainFile /etc/httpd/conf/ssl/gd_bundle.crt

Copy the ssl ( Certificates and Keys ) to this server by

scp -r /etc/httpd/conf/ssl 192.168.1.146:/etc/httpd/conf/

7. Make a new file /etc/httpd/conf/workers.properties having following entry

worker.list=worker1 
worker.worker1.type=ajp13 
worker.worker1.host=localhost 
worker.worker1.port=8009 

8. Restart httpd . and test https://<Servername>/ . It should open the page which is opening at http://<ServerName>:8080/

Testing

Go to URL https://192.168.1.215/ page and it should display the moothod login page . Enter the application with right credentials , you should be seamlessly working .

Also , normal http ( not https) should give you pages like test page of apache or for pgadmin you should get it via http://192.168.1.215/phpPgAdmin and so on . That means your old apache application / URLs should work as it is.