https://bugzilla.redhat.com/show_bug.cgi?id=1806398
--- Comment #62 from Ted (Jong Seok) Won <jwon(a)redhat.com> ---
Mitigation:
The issue can be mitigated as follows:
1. If your site is not actively using the AJP Connector, simply comment it out
from the <TOMCAT_HOME>/conf/server.xml file as
~~~
<!-- <Connector port = "8009" protocol = "AJP / 1.3"
redirectPort = "8443" />
-->
~~~
2. If AJP connector is a requirement and cannot be commented/deactivated, then,
it is recommended to configure requiredSecret for the AJPConnector to set the
AJP protocol authentication credentials. For example (note that
YOUR_TOMCAT_AJP_SECRET must be changed to a value that is highly secure and
cannot be easily guessed):
~~~
<Connector port = "8009"
protocol = "AJP / 1.3"
redirectPort = "8443"
address = "YOUR_TOMCAT_IP_ADDRESS"
requiredSecret = "YOUR_TOMCAT_AJP_SECRET" />
~~~
When the above setting is configured, the same secret value on the front-end
proxy (mod_proxy_ajp or mod_jk) will be required to be configured.
* mod_proxy_ajp
secret can be added to ProxyPass. secret property support was added since
JBCS httpd 2.4.37 or since RHEL 7 httpd-2.4.6-67.el7.x86_64 (by
https://bugzilla.redhat.com/show_bug.cgi?id=1397241)
~~~
ProxyPass /example/ ajp://localhost:8009/example/ secret=YOUR_TOMCAT_AJP_SECRET
~~~
* mod_jk
secret can be specified to worker in workers.properties. secret support was
added in mod_jk 1.2.12 onwards.
~~~
worker.<WORKER_NAME>.secret=YOUR_TOMCAT_AJP_SECRET
~~~
Note that mod_cluster does not support secret property.
--
You are receiving this mail because:
You are on the CC list for the bug.