Web Server Security

All of these other reviews, including some of the popular spotlights, seem to be about the first edition with quite a few people saying they were disappointed. I never read the first edition, so I can’t remark on its content. However, this second edition seems to have all the details you need to get up and running, and Tomcat is not an area of my expertise.

In many cases Tomcat is a good choice for a web server, and it is well suited as a high performance production web server. It is also a free and open source servlet and JSP engine. You can use it by itself or with other web servers such as Apache httpd. The book is a user’s guide for Tomcat, not a tutorial on how to write web applications. That misunderstanding might have had some readers disappointed. Thus, you don’t need to be a programmer to understand the book – it is targeted more at system administrators. The following is a run down of the table of contents:

Chapter 1. Getting Started with Tomcat – explains how to install Tomcat, get it running, and test it to make sure that it’s functioning properly.

Section 1.1. Installing Tomcat

Section 1.2. Starting, Stopping, and Restarting Tomcat

Section 1.3. Automatic Startup

Section 1.4. Testing Your Tomcat Installation

Section 1.5. Where Did Tomcat Come From?

Chapter 2. Configuring Tomcat – shows the various places to look for information about your server, how to find out why things aren’t working, and gives you some examples of common mistakes in setting up and configuring Tomcat.

Section 2.1. A Word About Using the Apache Web Server

Section 2.2. Relocating the Web Applications Directory

Section 2.3. Changing the Port Number from 8080

Section 2.4. Java VM Configuration

Section 2.5. Changing the JSP Compiler

Section 2.6. Managing Realms, Roles, and Users

Section 2.7. Controlling Sessions

Section 2.8. Accessing JNDI and JDBC Resources

Section 2.9. Servlet Auto-Reloading

Section 2.10. Customized User Directories

Section 2.11. Tomcat Example Applications

Section 2.12. Common Gateway Interface (CGI)

Section 2.13. The Tomcat Admin Webapp

Chapter 3. Deploying Servlet and JSP Web Applications in Tomcat – shows web applications composed of servlets, JSPs, and other files, and several approaches for deploying them. It ends with a discussion of the Manager web application, which can handle some deployment operations for you.

Section 3.1. Hosts

Section 3.2. Layout of a Web Application

Section 3.3. Deploying an Unpacked Webapp Directory

Section 3.4. Deploying a WAR File

Section 3.5. Hot Deployment

Section 3.6. Working with WAR Files

Section 3.7. The Manager Webapp

Section 3.8. Automation with Apache Ant

Section 3.9. Symbolic Links

Chapter 4. Tomcat Performance Tuning – some ideas on performance tuning the underlying Java runtime and the Tomcat server itself so that you service requests more efficiently.

Section 4.1. Measuring Web Server Performance

Section 4.2. External Tuning

Section 4.3. Internal Tuning

Section 4.4. Capacity Planning

Section 4.5. Additional Resources

Chapter 5. Integration with the Apache Web Server – covers the use of Tomcat with Apache httpd and talks about the several ways of making Tomcat thrive in front of or behind an Apache httpd installation.

Section 5.1. The Pros and Cons of Integration

Section 5.2. Installing Apache httpd

Section 5.3. Apache Integration with Tomcat

Section 5.4. Tomcat Serving HTTP over the APR Connector

Chapter 6. Tomcat Security – details about what security is and how to improve it in your Tomcat installation.

Section 6.1. Securing the System

Section 6.2. Multiple Server Security Models

Section 6.3. Using the SecurityManager

Section 6.4. Granting File Permissions

Section 6.5. Setting Up a Tomcat chroot Jail

Section 6.6. Filtering Bad User Input

Section 6.7. Securing Tomcat with SSL

Chapter 7. Configuration – Using realms this chapter shows how to set up an example JDBC domain to talk to a relational database. Realms are lists of users authorized to implement specific sections of your web site. Many of the other configuration changes you can make are discussed too.

Section 7.1. server.xml

Section 7.2. web.xml

Section 7.3. tomcat-users.xml

Section 7.4. catalina.policy

Section 7.5. catalina.properties

Section 7.6. context.xml

Chapter 8. Debugging and Troubleshooting – Ways to look for information that helps discover why things aren’t working and gives examples of mistakes that are commonly made but may not be obvious. Also discusses why Tomcat may not shut down gracefully and what to do about this common problem, as well as ways of preventing abnormal shutdowns from recurring.

Section 8.1. Reading Logfiles

Section 8.2. Hunting for Errors

Section 8.3. URLs and the HTTP Conversation

Section 8.4. Debugging with RequestDumperValve

Section 8.5. When Tomcat Won’t Shut Down

Chapter 9. Building Tomcat from Source – How to compile your own Tomcat in case you don’t want to run a prebuilt binary release of it. Gives step-by-step instructions on how to install the Apache Ant build tool, download all necessary support libraries, and build your Tomcat.

Section 9.1. Installing Apache Ant

Section 9.2. Obtaining the Source

Section 9.3. Downloading Support Libraries

Section 9.4. Building Tomcat

Chapter 10. Tomcat Clustering – Some options for running multiple Tomcat servlet containers in parallel for both fault tolerance and higher scalability, while discussing the pros and cons of various clustering approaches.

Section 10.1. Clustering Terms

Section 10.2. The Communication Sequence of an HTTP Request

Section 10.3. Distributed Java Servlet Containers

Section 10.4. Tomcat 6 Clustering Implementation

Section 10.5. JDBC Request Distribution and Failover

Section 10.6. Additional Resources

Chapter 11. Final Words – Overview of the Tomcat open source project’s community resources, including docs, mailing lists, and other web sites.

Section 11.1. Supplemental Resources

Section 11.2. Community

Appendix A. Installing Java

Section A.1. Choosing a Java JDK

Section A.2. Working Around Older GCJ and Kaffe JVMs

Section A.3. Sun Microsystems Java SE JDK

Section A.4. IBM J9 JDK

Section A.5. BEA JRockit JDK

Section A.6. Apple Java SE JDK

Section A.7. Excelsior JET

Section A.8. Apache Harmony JDK

Appendix B. jbchroot.c

Appendix C. BadInputValve.java

Appendix D. BadInputFilter.java

Appendix E. RPM Package Files
Rating: 5 / 5

Jason Brittain and Ian F. Darwin’s TOMCAT: THE DEFINITIVE GUIDE, 2ND EDITION has been updated for the latest version of Tomcat and offers a complete guide to installing the servlet container, from basics of installation to using web applications, securing Tomcat from online intruders, troubleshooting and customizing the program. Any advanced computer collection strong in Java programming needs this.
Rating: 5 / 5