All Versions
- DSpace 7.x (Current Release)
- DSpace 8.x (Unreleased)
- DSpace 6.x (EOL)
- DSpace 5.x (EOL)
- More Versions...
...
Warning |
---|
When using Apache 2.4.2 (and lower) in front of a DSpace webapp deployed in Tomcat, mod_proxy_ajp and possibly mod_proxy_http breaks the connection to the back end (Tomcat) prematurely leading to response mixups. This is reported as bug CVE-2012-3502 ( http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3502 ) of Apache and fixed in Apache 2.4.3 (see http://www.apache.org/dist/httpd/CHANGES_2.4) . The 2.2.x branch hasn't shown this problem only the 2.4.x branch has. |
Note |
---|
Before following these instructions, it's HIGHLY recommended to first get DSpace running in standalone Tomcat on port 8080. Once DSpace is running, you can use the below instructions to add Apache HTTP Server in front of Tomcat in order to allow DSpace to run on port 80 and optionally port 443 (for SSL). |
One of the easiest routes to both running DSpace on standard ports (80 and 443) as well as using HTTPS is to install install Apache HTTPDHTTP Server as your primary HTTP server, and use it to forward requests to Tomcat.
In your Tomcat's server.xml
, ensure that the AJP Connector is UNCOMMENTED. Usually this runs on port 8009, but you can decide to change the port if you desire
Code Block |
---|
<!-- Define an AJP 1.3 Connector on port 8009 --> <Connector port="8009" protocol="AJP/1.3" /> |
sudo a2enmod proxy proxy_ajp
Create a new Virtual Host in Apache HTTPD HTTP Server to represent your DSpace site. Here's a basic example of a Virtual Host responding to any port 80 requests for "my.dspace.edu":
Code Block |
---|
<VirtualHost *:80> # Obviously, replace the ServerName with your DSpace site URL ServerName my.dspace.edu ## Apache HTTPDHTTP Server Logging Settings - modify how you see fit ErrorLog ${APACHE_LOG_DIR}/my.dspace.edu-error.log CustomLog ${APACHE_LOG_DIR}/my.dspace.edu-access.log combined # Possible values include: debug, info, notice, warn, error, crit, alert, emerg. LogLevel warn # There are many more configurations available for Virtual Hosts, # see the documentation for more details # http://httpd.apache.org/docs/2.4/vhosts/ </VirtualHost> |
If you want your site to also respond to SSL requests, you'll need to install and enable "mod_ssl" and create a second Virtual Host to respond to port 443 requests. An example is provided below. But much more details are available in the Apache HTTD HTTP SSL Documentation and the mod_ssl documentation
Code Block |
---|
<VirtualHost *:443> # Obviously, replace the ServerName with your DSpace site URL ServerName my.dspace.edu # You can have SSL Apache logging settings here too (see the port 80 example above) # Configure your SSL Certificate (you must create one, obviously) # See the "keytool" instructions above for examples of creating this certificate # There are also many good guides on the web for generating SSL certificates for Apache SSLEngine on SSLCertificateChainFile /path/to/your/chainfile.crt SSLCertificateFile /path/to/your/public-cert.crt SSLCertificateKeyFile /path/to/your/private-key.key # More information on SSL configurations can be found in the mod_ssl documentation # http://httpd.apache.org/docs/2.4/mod/mod_ssl.html </VirtualHost> |
Info | ||
---|---|---|
| ||
If you are using X.509 Client Certificates for authentication: add these configuration options to the appropriate httpd configuration file, e.g. ssl.conf, and be sure they are in force for the virtual host and namespace locations dedicated to DSpace:
|
In each of your Apache HTTPD HTTP Virtual Hosts (see above), use "ProxyPass" configurations to configure the redirects from Apache HTTPD HTTP Server to Apache Tomcat. The exact configurations depend on whether you want to redirect ALL requests to Tomcat, or just certain paths. Here's a basic example. But much more information and examples can be found in the mod_proxy documentation
Code Block |
---|
# These are just examples. THEY LIKELY WILL NEED MODIFICATION. # Again, remember to add these to your EXISTING <VirtualHost> settings <VirtualHost> ... (existing settings) ... # If there's a single path you do NOT want redirected, you can use ! to ignore it # In this case any requests to "/ignored_path" will be handled by Apache HTTPD and NOT forwarded to Tomcat ProxyPass /ignored_path ! # These configurations say: By default, redirect ALL requests to port 8009 # (The port MUST match the port of your Tomcat AJP Connector. By default this usually is 8009) ProxyPass / ajp://localhost:8009/ ProxyPassReverse / ajp://localhost:8009/ # You may also wish to provide additional "mod_proxy" configurations, # for more examples and details see the documentation at # http://httpd.apache.org/docs/2.4/mod/mod_proxy.html </VirtualHost> |
...