Proxing to tomcat with httpd Jean-Frederic Clere Principal Software Engineer / Red Hat What I will cover ● Proxy what and why. ● Protocols – AJP – HTTP/HTTPS (1.1) – HTTP/2 (H2 and H2C) – Others reverse proxy – ● Supported by httpd 11 10/12/22 Demultiplexing h2 in proxy ● Keep the back-end unchanged ● Keep the overhead of h2 proxy 12 10/12/22 Other proxies ● HAProxy (in the cloud / openshift for example) ● mod_cluster (httpd dynamic load balancer) ● Undertow proxy (jboss servlet container) ● Ingress (in kubernetes, well

website at http://httpd.apache.org/docs/2.4/ The Apache HTTP Server Documentation is maintained by the Apache HTTP Server Documentation Project. More information is available at http://httpd.apache.org/docs-project/ Dynamic Content with CGI . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224 6.5 Apache httpd Tutorial: Introduction to Server Side Includes . . . . . . . . . . . . . . . . . . . . . 231 6.6 Supporting Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278 8.2 httpd - Apache Hypertext Transfer Protocol Server . . . . . . . . . . . . . . . . . . . . . . . . . . 279

website at http://httpd.apache.org/docs/2.4/ The Apache HTTP Server Documentation is maintained by the Apache HTTP Server Documentation Project. More information is available at http://httpd.apache.org/docs-project/ Dynamic Content with CGI . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224 6.5 Apache httpd Tutorial: Introduction to Server Side Includes . . . . . . . . . . . . . . . . . . . . . 231 6.6 Supporting Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278 8.2 httpd - Apache Hypertext Transfer Protocol Server . . . . . . . . . . . . . . . . . . . . . . . . . . 279

website at http://httpd.apache.org/docs/2.4/ The Apache HTTP Server Documentation is maintained by the Apache HTTP Server Documentation Project. More information is available at http://httpd.apache.org/docs-project/ Dynamic Content with CGI . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232 6.5 Apache httpd Tutorial: Introduction to Server Side Includes . . . . . . . . . . . . . . . . . . . . . 239 6.6 Supporting Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300 8.2 httpd - Apache Hypertext Transfer Protocol Server . . . . . . . . . . . . . . . . . . . . . . . . . . 301

website at http://httpd.apache.org/docs/2.4/ The Apache HTTP Server Documentation is maintained by the Apache HTTP Server Documentation Project. More information is available at http://httpd.apache.org/docs-project/ Dynamic Content with CGI . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232 6.5 Apache httpd Tutorial: Introduction to Server Side Includes . . . . . . . . . . . . . . . . . . . . . 239 6.6 Supporting Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300 8.2 httpd - Apache Hypertext Transfer Protocol Server . . . . . . . . . . . . . . . . . . . . . . . . . . 301

website at http://httpd.apache.org/docs/2.2/ The Apache HTTP Server Documentation is maintained by the Apache HTTP Server Documentation Project. More information is available at http://httpd.apache.org/docs-project/ Supporting Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264 8.2 httpd - Apache Hypertext Transfer Protocol Server . . . . . . . . . . . . . . . . . . . . . . . . . . 265 should edit httpd.conf to include the relevant MOD SSL directives and then use apachectl start to start the server. An example configuration to activate MOD SSL has been included in conf/extra/httpd-ssl.conf

website at http://httpd.apache.org/docs/2.0/ The Apache HTTP Server Documentation is maintained by the Apache HTTP Server Documentation Project. More information is available at http://httpd.apache.org/docs-project/ Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236 CONTENTS v 8.2 httpd - Apache Hypertext Transfer Protocol Server . . . . . . . . . . . . . . . . . . . . . . . . . . 237 your httpd.conf. In order to assure that Apache reads the configuration files in the same order as was implied by the older directives, the INCLUDE directives should be placed at the end of httpd.conf

httpd 启动服务 service foo restart systemctl restart httpd 重启服务 61 service foo stop systemctl stop httpd 停止服务 service foo reload systemctl reload httpd 重新加载配置文件（不终止服务） systemctl status httpd 查看服务状态 表 1-5 服务开机启动、不启动、查看各级别下服务启动状态等常用命令 chkconfig foo on systemctl enable httpd 开机自动启动 chkconfig foo off systemctl disable httpd 开机不自动启动 chkconfig chkconfig foo systemctl is-enabled httpd 查看特定服务是否为开机自启动 chkconfig --list systemctl list-unit-files --type=httpd 查看各个级别下服务的启动与禁用 情况 1.6 重置 root 密码 平日里让运维人员头疼的事情已经很多了，偶尔忘记 Linux 系统密码的事情也很常见。

以及服务器软件提供的相关功能了。举例来 说，你可以在 httpd.conf 这个配置文件之内规范某些 IP 来源不能使用 httpd 这个服务来取得主机的数据， 那么即使该 IP 通过前面两层的过滤，他依旧无法取得主机的资源喔！但要注意的是， 如果 httpd 这支程序本来 就有问题的话，那么 client 端将可直接利用 httpd 软件的漏洞来入侵主机，而不需要取得主机内 root 的密 因此即使使用者的档案权限设定错误，以及程序有问题时，该程序能够进行的动作还 是被限制的，即使该程序使用的是 root 的权限也一样。举例来说，前一个步骤的 httpd 真的被 cracker 攻击 而让对方取得 root 的使用权，由于 httpd 已经被 SELinux 控制在 /var/www/html 里面，且能够进行的功 能已经被规范住了，因此 cracker 就无法使用该程序来进行系统的进一步破坏啰。现在这个 WWW 资料是 啥？就是档案啊！^_^！所以，最终网络封包其实是要向主机要求文件系统的数据啦。 我们这里假设你要使用 httpd 这支程序来取得系统的档案数据，但 httpd 默认是由一个系统账号名称为 httpd 来启动的，所以：你的 网页数据的权限当然就是要让 httpd 这支程序可以读取才行啊！如果你前面三关的设定都 OK ，最终权限设定错 误，使用者依旧无法浏览你的网页数据的。 在这些步骤之外，我们的

(Isovalent) October 28, 2020 10.0.0.1 10.0.0.2 10.0.0.3 httpd httpd “httpd” service 10.0.0.1:30000 10.0.0.2:30000 10.0.0.3:30000 httpd httpd 1010101010111 1010101010111 1010101010111 1010101010111 "default/nginx-57: has no endpoints" -m tcp --dport 80 -j REJECT --reject-with icmp-port-unreachable COMMIT httpd httpd void loadbalance(skb) { svc = bpf_map_lookup_elem(..); if (svc) { b = select_backend(svc); POSTROUTING nat POSTROUTING TC egress host httpd pod lxc0 eth0 XDP httpd httpd 1010101010111 1010101010111 1010101010111 DSR httpd httpd 1010101010111 1010101010111 Consistent hashing