Enabling SSL in Apache Tomcat 6 The Easy Way

NOTE: This article does not use the APR tomcat module but rather the default Tomcat 6 deployment.

To enable SSL for Apache Tomcat 6, perform the following:

1. Create an SSL certificate using the java supplied keytool:

$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA

NOTE: If you get the error:
keytool error: java.lang.Exception: Key pair not generated, alias <tomcat> already exists
Then most probably you have a key file already in your user directory. If you are root, this will be /root/.keystore

2. You will be requested for data that will show on your user browser's certificate, fill them all in.
Notice that the bold font is my input. No problem if you stick to the password "changeit" as it is the default password used by tomcat.

Enter keystore password: changeit
Re-enter new password: changeit
What is your first and last name: Jeremy Atkins
What is your organizational unit: OU
What is the name of your organization: NOYO
What is the name of your city or your locality: MyCity
What is the name of your state or province: Saudi Arabia
What is the two-letter country code for this unit:  uk
Is the entered data correct: yes

Enter key password for <tomcat>
        (RETURN if same as keystore password): PRESS RETURN KEY

It is important to have the keystore password and the key password the same. This is done by pressing the RETURN KEY in the last step. This is necessary since Tomcat doesn't support having different passwords in the keystore and key.

3. When you're done with the previous step, a keystore file gets created in the user directory named keystore. Since I'm the root user, I will find it in /root/.keystore.
Check that the file /root/.keystore got created.

4. Next, open the tomcat server.xml for editing:
vi ${tomcat_installation_dir}/conf/server.xml

And uncomment the following section by removing the <!-- and the --> surrounding them from top and bottom:

   <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS"
               />

5. Change the port number from 8443 to 443 which is the default SSL port known to all browsers.
Switch to 8443 while in development if needed.

   <Connector port="443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS"
               />

6. Now add the following line in between to tell tomcat where to locate the keystore and specify the password you specified:

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
   maxThreads="150" scheme="https" secure="true"
   clientAuth="false" sslProtocol="TLS"
   keystoreFile="${user.home}/.keystore" keystorePass="changeit"
               />

Tomcat will automatically replace ${user.home} with the path of the home directory for the user tomcat is running under. Which in my case is "/root"

7. Restart apache tomcat using:

<tomcat_installation_dir>/bin/catalina.sh stop

<tomcat_installation_dir>/bin/catalina.sh start

Reference: http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html

Disabling WebDAV DELETE, PUT, OPTIONS in Apache Tomcat 6

It really took me more than two hours searching over the internet just to understand how to do this simple configuration of disabled the WebDAV methods in apache tomcat 6 for all applications.

Here is how to do it:

In your apache tomcat 6 installation, simply open the file <installation_directory>/conf/web.xml for editing. Note that this web.xml file acts as a global file for all web applications and is processed before the web.xml's web application file.

At the end of the global web.xml file and just before the closing tag place the following text:

<security-constraint>
<web-resource-collection>
<web-resource-name>restricted methods</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>PUT</http-method>
<http-method>DELETE</http-method>
<http-method>OPTIONS</http-method>
<http-method>TRACE</http-method>
</web-resource-collection>
<auth-constraint />
</security-constraint>

The above security-constraint simply denies the above WebDAV methods to be processed by tomcat and returns a forbidden message.

The <auth-constraint /> simply means: "For any user, deny access to PUT, DELETE, OPTIONS, and TRACE methods".

After that, restart apache tomcat 6 using:

<installation_directory>/bin/catalina.sh stop

<installation_directory>/bin/catalina.sh start

To be able to verify that these methods are now forbidden, I used some javascript jquery code:

1. Open firefox with the firebug plugin installed

2. Open a webapplication that has jquery javascript file included within it.

3. Open firebug and select the "Console" tab from firebug

4. Write the following javascript code:

$.ajax({

  type: 'DELETE',

  url: "http://212.138.70.94",

  data: {},

  error: function() {alert('ERROR');},

  success: function() {alert('SUCCESS');},

});

5. Click the Run button.

6. You should see an alert dialog with the message ERROR and a response in firebug with the following message:

"NetworkError: 403 Forbidden - http://212.138.70.94/"

7. Repeat the above for the OPTIONS, TRACE and PUT methods.

I'm sure there's a simpler way to verify it other than javascript. But I don't know how.

Should You Go Beyond Relational Databases?

A wonderful article by Martin Kleppmann from thinkvitamin:
http://thinkvitamin.com/code/should-you-go-beyond-relational-databases/

Looking for Java Screen Casts, Try SoftDevTube.com

http://www.softdevtube.com

Creativity is Not Design

From: http://jessewilson.net/notes/creativity-is-not-design

Too often I notice designers and non-designers alike equating creativity with design. I find this assumption disturbing because it is one of the many fallacies that allow unskilled but creative pretenders to consider themselves capable design professionals when they’re nothing of the sort… Creativity is bound by no laws, rules, or strictures… Design, on the other hand, is based entirely on math, psychology, human perception, and a host of rigid rules and laws that can be broken by only a highly skilled few…

Automatic Java Class Diagram Generation Using ObjectAid

I was looking for a tool that would allow me to view my classes graphically, until I bumped into this question from stackoverflow.com:

http://stackoverflow.com/questions/1120032/what-is-your-favorite-automatic-class-diagram-generator-for-eclipse

And after trying several tools, I think ObjectAid beats'em all.

Object Aid Website:
http://www.objectaid.com/

Effective API Design

http://www.infoq.com/presentations/effective-api-design

A Wonderful Tool Called Briss, Crop your PDF margins for Kindle Reading

Wonderful tool that will crop the white spaces in your PDFs to make them clearly readable on your Kindle 3.
http://sourceforge.net/projects/briss/
Its freeware.

Important Information Concerning SATA 3 Support on Laptops / Notebooks

Read this question:
http://superuser.com/questions/234754/revision-3-sata-6gb-s-capable-laptops-do-they-exist

Then this link:
http://www.intel.com/products/notebook/chipsets/ec-qm67/ec-qm67-overview.htm

Then this link:
http://www.intel.com/Assets/PDF/datasheet/324645.pdf

When purchasing a laptop, check for a 6 series intel chipset.
They are supported on laptops with the QM67, QS67, HM65, UM67, and HM67 chipset.

Adobe Photoshop Tutorials, Tips and Articles From PSD.TUTSPLUS.COM

http://psd.tutsplus.com

15 ways to make great websites for less

http://www.netmagazine.com/features/15-ways-make-great-websites-less

This article contains wonderful tools for creating websites.

Kuler - A tool to help you select color themes for your website

http://kuler.adobe.com

Its online. Its free.

Good Ideas Glow In The Dark

Setting a default program to open files with unknown extensions or no extension on Windows 7

I always get frustrated having to select a program to open a file when most of the time this program is notepad.

I searched the internet for a way to define a default program to open files for all other files that have extensions not defined on windows. Luckily, I found this article:
http://www.fortypoundhead.com/showcontent.asp?artid=2738

To modify the registry you have to run regedit.exe and modify or add the following:

[HKEY_CLASSES_ROOT\*\shell]

[HKEY_CLASSES_ROOT\*\shell\open]
@="Open With Notepad"

[HKEY_CLASSES_ROOT\*\shell\open\command]
@="notepad.exe %1"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.]
"Application"="Notepad"

Note the following, if the key does not exist, you have to create it.
Example, create the key "open" and created under it the key "command"
Also @= means the default value for the key
Application=Notepad means you have to create a string value containing Application and value Notepad
Also, the last key make sure to notice the ".", its not "FileExts" but rather "FileExts\.", a subkey inside FileExts labeled dot.

Or simply, the above could be saved into a *.reg file and executed.

After that you will get in the context menu the option to open with Notepad for any unknown file.

The Rise Of Mashups

As much as I hate the over-over-over-engineered java Portlet specification JSR-168 and JSR-268, as much as I  felt safe with the Mashup concept. Though in its early stages, I believe mashups will eventually replace Portals and Portlets forever.

To follow up on Java mashup news, keep a close eye on the following:
http://www.jackbe.com/enterprise-mashup/mashups-and-java/

An excellent article explaining custom tags in JSP2

This is an excellent article explaining custom tags in JSP2:
http://www.vsj.co.uk/java/display.asp?id=408

The custom tag development has been simplified and the complicated java API is no longer needed to develop a custom tag. A *.tag file is created instead.

JSP custom tags are an advantage in the JSP language that does not exist in other web technologies I'm aware of (ie. PHP).

Ten Ideas for Making Sys Admins Life Easier

http://queue.acm.org/detail.cfm?id=1921361

A message from administrators to application vendors:
1. DO have a "silent install" option.
2. DON'T make the administrative interface a GUI.
3. DO create an API so that the system can be remotely administered.
4. DO have a configuration file that is an ASCII file, not a binary blob.
5. DO include a clearly defined method to restore all user data, a single user's data, and individual items
6. DO instrument the system so that we can monitor more than just, "Is it up or down?"
7. DO tell us about security issues.
8. DO use the built-in system logging mechanism 
9. DON'T scribble all over the disk.
10. DO publish documentation electronically on your Web site.

Three Common Application Problems Developers Should Watch Out For

Read this: http://www.theserverside.com/news/thread.tss?thread_id=61566

Then this:http://java.dzone.com/articles/three-common-application

In summary:

- ORMs can really be dangerous on your application if you don't understand whats happening internally.

- Very few developers (a fringe of a fringe) really understand threading and can write multithreaded applications.

- Memory leaks take place in java by not closing and freeing resources and could become a real performance problem if not tracked correctly.

Finding Free Use Fonts

Don't look any further: http://www.fontsquirrel.com

Wonderful site with many free for use fonts.

Denying A Program To Connect To A Network

Imagine that one day you download a free password manager on your windows machine, and use it to store all your passwords for online banking accounts, emails, etc.

Knowing that this same executable is capable of connecting to the internet and doing different things like connecting to a server and checking for updates...

Imagine that one day the guy developing the tool inserted some malicious code to forward password information in your password manager.

Paranoid thinking? But can we blame paranoids, I mean the world is full of negative surprises that only paranoids were able to predict.

Better than blaming, is protecting yourself without losing the privilege of the software you want to use. On windows 7, here's how:

1. Go to the Control Panel.
2. Click on the Windows Firewall icon.
3. Make sure that your windows firewall is turned on by clicking on Turn Windows Firewall on or off
4. When this is done, go back to the Windows Firewall and click on "Advanced Settings".
5. Click on "Outbound Rules"
6. On the right, click on "New Rule..."
7. Make sure Program is selected in the radio buttons and click Next.
8. Enter the path of the program exe then click Next.
9. Make sure "Should be Blocked" is selected then click Next.
10. Enter a display name for this rule.
11. Click Finish.
12. Open the desktop tool you want to protect against and select "Check for updates.." in your tool if available. The tool should crash or tell you that it is unable to connect to the internet. No connection available.

Capiche. You're done.