This tutorial shows how to prepare the server for test or production use of CzechIdM. If you are looking for much quicker way of how to start the CzechIdM, use the demo setup described here getting-started

Basic system setup

• 1 server (can be virtualized) for everything: backend, frontend and database.
• OS Linux with EPEL repository enabled - CentOS, basic network enabled installation
  • It is possible to use Debian (we tested on Stretch) or other distributions, but you have to adjust steps in this guide accordingly.
• PostgreSQL 12.x - installed from OS packages.
• Java 11 (Java 21 for CzechIdM 13.1.0+) - installed from OS packages.
• Apache Tomcat 9.0.x - installed manually into /opt/tomcat.
• Apache HTTPd 2.4.x - installed from OS packages. Can be replaced by nGinx.
• All services start via systemd.
• Each service runs under dedicated non-privileged user.

Instalation and software configuration

Prerequisities - Basic installation of CentOS 8

PostgreSQL

We install PostgreSQL 12 database binaries and change database data directory from /var/lib to /data.

Database server installation - CentOS8

• Software installation on CentOS8(versions can vary):

• create new directory for database data:

• Copy the PostgreSQL's systemd unit to the /etc:

In the file /etc/systemd/system/postgresql.service change the directory for data as follows:

• In the file /var/lib/pgsql/.bash_profile (bash profile for postgres user) change the variable PGDATA to:

• Reload changes:

• Initialize database:

Change SELINUX labels:

• Enable and start database:

• Check that the database is running:

Database server configuration and sizing

• Enable the password authentication.

In the file /data/pgsql/12/data/pg_hba.conf find lines:

and change the value at the end of each line to md5 like this:

• Adjust DB instance sizing.
  • In following snippet, we presume the system has 3GB of memory dedicated for the database and about 100 db connections. For your deployment, adjust the sizing accordingly. Use a calculator if in doubt.
  • We also log queries running longer than 200ms.

In a file /data/pgsql/12/data/postgresql.conf change (or add) following lines:

• Restart the database

Java - CentOS8

Tomcat application server needs Java installed. We recommend to use OpenJDK 11 from standard OS repository. (OpenJDK 1.8 is also supported, check compatibility page).

Installation:

For CzechIdM 13.1.0+:

Tomcat

• Create a new group and add user for the tomcat to run under:

• change working directory into /opt/tomcat

• Download Apache Tomcat 9.0.x from the website https://tomcat.apache.org/download-90.cgi to /opt/tomcat/
  • In our exapmle the version is 9.0.45.

• extract files from the archive:

• create a new symbolic link to current user version (we presume there may be more versions at the server in future due to upgrades/updates)

• Set rights on files for tomcat user (still working under root):

Start Tomcat automatically after system startup

• Create startup script (systemd unit), in which we also set the basic JVM parameters:

• File content of /etc/systemd/system/tomcat.service:

• Reload systemd configuration:

• Start the Tomcat to ensure it is configured properly. Enable its start on OS start.

• Check that Tomcat runs with desirable parameters:

• Stop the Tomcat.

Apache Tomcat configuration

Interface Management

Apache Tomcat offers two applications for tomcat management available at:

• http://localhost:8080/manager
• http://localhost:8080/host-manager

If you want to use them, it is necessary to do following steps.

First of all, create a Tomcat's database user that you will use for the access to those applications. If you plan to connect to the applications remotely (not only from localhost) you have to also allow communication from your IP.

• Create administration user
  • Create the a new user in the file /opt/tomcat/current/conf/tomcat-users.xml and assign him roles "manager-gui" and "admin-gui".
  • The documentation of available roles as well as overall configuration of the application is a part of application installation available at http://localhost:8080/docs/manager-howto.html#Configuring_Manager_Application_Access

The file /opt/tomcat/current/conf/tomcat-users.xml should now look like this:

• If you plan to connect to the applications remotely (not only from localhost) you have to also allow communication from your IP.
  • If you see 403 Access Denied when accessing Tomcat's management remotely, it might be because you did not perform this configuration.

Add your IP address into application configuration files. In files /opt/tomcat/current/webapps/manager/META-INF/context.xml and /opt/tomcat/current/webapps/host-manager/META-INF/context.xml add netmask for your IP (both files should have the same content):

For example, if you want to access Tomcat's management from the network 192.168.0.0/24:

• Again, restart the tomcat

Apache Tomcat configuration recommended for production use

We advise to follow these steps to configure Tomcat for production deployment.

• Remove unnecessary applications that come with Tomcat:

• Turn off the shutdown port:
  • In the config file /opt/tomcat/current/conf/server.xml set value -1 from 8005 to the Server port tag, thus you deactivate it:

• Make Tomcat listen only on localhost:
  • In the /opt/tomcat/current/conf/server.xml add the address="127.0.0.1" property to configuration of 8080 port.

• Set the maxSwallowSize for the HTTP/1.1 connector:
  • In the /opt/tomcat/current/conf/server.xml, locate the configuration for port 8080 and add the maxSwallowSize="-1" property therein.

• In same file configure AJP port (8009/tcp) to look like this:

• Do not show aplication server version:
  • In the file /opt/tomcat/current/conf/web.xml set showServerInfo to false (default is true):

Rotating Tomcat logs

Default Tomcat logger appends to the logfile, it is therefore safe to use simple logrotate configuration. Save following as /etc/logrotate.d/tomcat, adjust log retention (the rotate COUNT) as necessary.

It is possible that, on some distros, SELinux will deny acces to the logfile for logrotate because logrotate_t is only allowed in the /var/log and subfolders. The logrotate will error to the /var/log/messages line similar to Sep 3 03:48:01 server.tld logrotate: ALERT exited abnormally with [1].

If this happens, set the permissive mode for logrotate:

Apache httpd as a reverse proxy

It is possible to open Apache Tomcat to the network directly, but little inconvenient. You want the users to access the CzechIdM on user-friendly ports 80/tcp or 443/tcp, which is not easy to setup in Tomcat itself running under nonprivileged user. So we use Apache httpd as a reverse proxy. Apache httpd will allow access to data via https on port 443/tcp and http on port 80/tcp. Communication via http protocol will be enabled, but we will redirect all communication to https. Communication between Apache httpd and Tomcat will take place on local machine via AJP protocol. In httpd, there will be mod_security installed (optional but recommended), which serves as an application firewall.

The configuration example is written for the server which allows access to its services under the name "demo.czechidm.com".

HTTPd installation and configuration

Install httpd and mod\_security:

HTTPd basic configuration:

Change MPM to worker - in the file /etc/httpd/conf.modules.d/00-mpm.conf comment-out all lines but mod\_mpm\_worker.so:

Disable "welcome" page:

Virtualhost configuration to forward the communication from port 80 to 443. Add following section and change string 'SERVER' to the real servername in the file /etc/httpd/conf.d/vhost-redirect.conf:

Set the proxy in the virtualhost for https (443/tcp) - at the end of the file /etc/httpd/conf.d/ssl.conf add following before ending "tag" VirtualHost:

In IE 11, CzechIdM has problems with missing icons. Icons are created by special fonts and those fonts are handled badly in the IE. It is necessary to set Cache-Control HTTP header. We need to set it only for font files:

Identity manager CzechIdM will be available on address https://server/idm/ It is possible to forward from / to /idm/, so that the user does not need to type the whole URL. To do so, add following lines to the virtualhost config file (ssl.conf):

Certificate for httpd

If you have prepared certifikate, key and certificate authority chain just chnge these properties in /etc/httpd/conf.d/ssl.conf and make sure that only httpd can read the files.

Then continue with cheking syntax of httpd.

If you not prepared them in the moment. Create temporary certificate and key.

Then change set path to them in these properties in /etc/httpd/conf.d/ssl.conf.

Checking httpd configuration syntax and configuring selinux

Syntax check before httpd restart

httpd restart and reload configuration changes:

Allow in SELINUX to httpd connect to network:

Enable httpd after OS start:

mod_security configuration

Mod_security files locations (on CentOS8):

• Audit log: /var/log/httpd/modsec\_audit.log
• Directory with activated rules: /etc/httpd/modsecurity.d/activated\_rules/
• basic configuration file for mod\_security:  /etc/httpd/modsecurity.d/activated_rules/REQUEST-901-INITIALIZATION.conf
• The file for chosen rules deactivation: /etc/httpd/conf.d/ssl.conf

The default set of rules is relatively strict. CzechIdM cannot run with the default configuration of mod_security.

Each rule is identified by a unique ID. If you want to deactivate the whole rule, it is advised to write the rule ID into ssl.conf like this:

Disabling mod_security rules

These rules are disabled for modsec_crs 3.0.

In the file /etc/httpd/conf.d/ssl.conf deactivate following rules and set their logging:

mod_security configuration - CentOS8

Edit the file /etc/httpd/modsecurity.d/activated_rules/REQUEST-901-INITIALIZATION.conf.

• find the rule 900200 and add methods PUT, DELETE and PATCH on the line starting tx.allowed\_methods. It should look like this after change:

• find the rule 900220 and add support for content type application/hal+json on the line starting with tx.allowed\_request\_content\_type. Result should look like this:

mod_deflate configuration

It is advised to set up gzip so the users get minimum of data from the frontend server. In the file /etc/httpd/conf.d/ssl.conf we add following configuration and restart the server: