Skip to main content

Tomcat: Securing the iDashboards Application

John Lin
  • Updated

This requires being connected to your server and editing the context.xml or web.xml file.

Here are some simple steps that can be taken to secure your information within the Tomcat structure. The two configurations we will look at are httpOnly, and custom 404/500 error messages.

HttpOnly

Custom 404 and 500 Error Messages - **Sample HTML**

Securing Tomcat Root Directory - **Sample HTML**

HttpOnly

  1. To ensure it is working, add the following configuration by editing the context.xml file located:
    • Tomcat 6.5 and later the option is turned on automatically
      • $CATALINA_BASE\conf Folder
        • Default: $CATALINA_BASE directory will be similar to
          • C:\Program Files\Apache Software Foundation\Tomcat 7.0\ directory
    • For v10+ Installations
      • Server/conf Folder 
        • Default: Server Directory will be similar to: 
          • C:\Program Files\iDashboards_SRV\Server\conf
  2. <Context> will be the first line that is not commented out. Edit this line as follows:
    •  <Context path="/idashboards" useHttpOnly="true">
  3. Now Save the file
  4. Restart Tomcat/iDashboardsSRV

HttpOnly

Securing Tomcat Root Directory - **Sample HTML**

Custom 404 and 500 Error Messages

This will create a redirect page so that when the application is down or the user types in the wrong address it will be forwarded to a page of your design. This helps secure the information that can be accessed.

    1. Locate the web.xml file
      • Default: $CATALINA_BASE will be in a directory similar to:
        • C:\Program Files\Apache Software Foundation\Tomcat 7.0\
      • Default: Server Directory will be similar to: 
        • C:\Program Files\iDashboards_SRV\Server\conf
    2. Go to the very bottom of the file. Find the Following:
    3. Below this section add the following:
    4. Create a folder call errors in: $CATALINA_BASE\webapps\idashboards
    5. Within that folder you will need to create the two html pages:
      • 404_Error.html

        <welcome-file-list>

        <welcome-file>index.jsp</welcome-file>

        </welcome-file-list>

        <error-page>

        <error-code>404</error-code>

        <location>/errors/404_Error.html</location>

        </error-page>

      • 500_Error.html

        <error-page>

        <error-code>500</error-code>

        <location>/errors/500_Error.html</location>

        </error-page>

  1. Copy contents and paste into the 500_Error.html
  2. Change 404 (<h1>ERROR 404</h1>) to 500 (<h1>ERROR 500</h1>)
  3. Save both files
  4. Repeat these steps in the idbalerts directory
  5. Restart Tomcat/iDashboardsSRV

**Sample HTML**

<html>
<head>
<meta content="text/html; charset=ISO-8859-1" http-equiv="content-type">
</head>
<body>
<div style="text-align: center;">
<h1>ERROR 404</h1>
You have reached this page in error. Please contact your iDashboards Administrator for assistance.<br>
</div>
</body>
</html>

HttpOnly

Custom 404 and 500 Error Messages - **Sample HTML**

Securing Tomcat Root Directory

We will be using some of the same methods but redirect all traffic to iDashboards.

  1. Delete everything except the WEB-INF directory under ROOT
  2. Create a file called index.html in the ROOT directory
  3. Copy the following HTML into index.html
    • This will redirect anyone that lands in the ROOT directory to iDashboards
  4. Go into the web.xml located in $CATALINA_BASE\ROOT\WEB-INF or Server\conf and find the Welcome text
  5. Now following the above text add
  6. Restart the Tomcat service (iDashboardsSRV)

**Sample HTML**

<html>

  <head>

    <meta http-equiv="refresh" content="0;URL=idashboards/index.jsp">

  </head>

  <body>

  </body>

</html>

 

<display-name>Welcome to Tomcat</display-name>

<description>

Welcome to Tomcat

</description>

 

<error-page>

<error-code>404</error-code>

<location>/index.html</location>

</error-page>

 

<error-page>

<error-code>500</error-code>

<location>/index.html</location>

</error-page>

If the above is unable to resolve the issue, then please contact iDashboards Support for further assistance.

HttpOnly

Custom 404 and 500 Error Messages - **Sample HTML**

Securing Tomcat Root Directory - **Sample HTML**

Related articles

Comments

0 comments

Please sign in to leave a comment.