Apache Tomcat Proxy Connector
I ran into some trouble configuring Apache/Tomcat on Fedora Core 6 using the Proxy AJP Module this week. Here are my final settings and a brief description of the problem and solution.
/etc/httpd/conf.d/proxy_ajp.conf :
LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
ProxyPass / http://localhost:9013/
server.xml :
<Connector acceptCount="100" connectionTimeout="20000" disableUploadTimeout="true" port="9013" redirectPort="8943" proxyName="www.myhost.com" proxyPort="80"/>
After settings things up, nothing worked. I found the following error in the Apache logfile:
[Fri Mar 30 02:23:34 2007] [error] (13)Permission denied: proxy: HTTP: attempt to connect to 127.0.0.1:9013 (localhost) failed
[Fri Mar 30 02:23:34 2007] [error] ap_proxy_connect_backend disabling worker for (localhost)
After digging around Google a bit, I finally found the following solution:
http://uppertank.net/blog/?m=200512
[root@clue conf]# getsebool -a
allow_execmem –> active
allow_execmod –> active
allow_execstack –> active
allow_kerberos –> inactive
allow_ypbind –> inactive
dhcpd_disable_trans –> inactive
httpd_builtin_scripting –> active
httpd_can_network_connect –> inactive
httpd_disable_trans –> inactive
httpd_enable_cgi –> active
httpd_enable_homedirs –> active
httpd_ssi_exec –> active
httpd_tty_comm –> inactive
httpd_unified –> active
mysqld_disable_trans –> inactive
named_disable_trans –> inactive
named_write_master_zones –> inactive
nscd_disable_trans –> inactive
ntpd_disable_trans –> inactive
portmap_disable_trans –> inactive
postgresql_disable_trans –> inactive
read_default_t –> active
snmpd_disable_trans –> inactive
squid_connect_any –> inactive
squid_disable_trans –> inactive
syslogd_disable_trans –> inactive
use_nfs_home_dirs –> inactive
use_samba_home_dirs –> inactive
winbind_disable_trans –> inactive
ypbind_disable_trans –> inactive
[root@clue conf]# setsebool httpd_can_network_connect true
[root@clue conf]# getsebool httpd_can_network_connect
httpd_can_network_connect –> active
[root@clue conf]#