Configuring Service Mode for JBoss

Introduction

Following document explain the steps to configure JBoss to run in a service mode. To Proceed with the document one should have the Administration level of knowledge on Windows Environment.

Steps to Configure Service

Prerequisites

App application Installed on windows & configured to run on JBoss version 6.0

Assumption

For Single Server deployed with the name ‘default’ and App.bat file is available under jboss6\bin folder which is previously used to run the application.
For Multiple Server deployed with the name ‘A1’, ‘App2’ and so on.
App1.bat, App2.bat, etc. files are available under jboss6\bin folder which is previously used to run the application.

For single server Setup

Create copy of the <Jboss>\bin\service.bat into another file with name ‘service_App.bat’

Configuration

1. Edit File service_App.bat & change following Properties.
   1. Search for
      set "SVCNAME=JBAS60SVC"
      Change it to
      set "SVCNAME=App_Jboss"
   2. Search for
      set SVCDISP=JBoss Application Server 6.0
      Change it to
      set SVCDISP=App JBoss Server 6.0
   3. Search for
      set SVCDESC=JBoss Application Server 6.0.0 GA/Platform: Windows %PROCESSOR_ARCHITECTURE%
      Change it to
      set SVCDESC=App JBoss Server 6.0.0 GA/Platform: Windows %PROCESSOR_ARCHITECTURE%
   4. Search for
      jbosssvc.exe -imwdc %SVCNAME% "%DIRNAME%" "%SVCDISP%" "%SVCDESC%" service.bat
      Change it to
      jbosssvc.exe -imwdc %SVCNAME% "%DIRNAME%" "%SVCDISP%" "%SVCDESC%" service_App.bat
   5. Search for (this will appear twice)
      call run.bat < .r.lock >> run.log 2>&1
      Change it to (Change both instance)
      call App.bat -c App -b 0.0.0.0 < .r.lock 2>&1
      If the server is running on specific IP then change it with following
      call App.bat -c App -b <IP_ADDRESS> < .r.lock 2>&1
   6. Search for (this will appear twice)
      call shutdown -S < .s.lock >> shutdown.log 2>&1
      Change it to (Change both instance)
      call shutdown --host=127.0.0.1 --port=1090 -S < .s.lock >> shutdown.log 2>&1
      If the server is running on specific IP then change it with following
      call shutdown --host=<IP_ADDRESS> --port=1090 -S < .s.lock >> shutdown.log 2>&1
2. Edit file App.bat and verify if following properties are set to correct path, if not then set it to the correct path. If the property does not exist, then add the same.
   1. set JBOSS_HOME=D:\jboss6
   2. set JBOSS_CLASSPATH=%RUN_CLASSPATH%;D:\jboss6\server\App\conf\properties;
   3. set "JAVA_HOME=D:\jdk1.6.0_25"

Install Service

3. Open Command Prompt (Run as Administrator if applicable) and change directory to <jboss>\bin\
4. Execute following command.
   service_App.bat install
5. Open Windows services, Service with the name “App JBoss Server 6.0”should be visible now. Try refresh if the services management snap in is already open.
6. Start service; wait for some time to get the service initialize.
7. View <Jboss_home>/server/App/logs/boot.log and check for any errors.
8. Service installation is completed at this point.

Uninstall Service

9. Open Command Prompt (Run as Administrator if applicable) and change directory to <jboss>\bin\
10. Execute following command.
    service_App.bat uninstall
11. Open Windows services, Service with the name “App JBoss Server 6.0”should have been disappeared now. Try refresh if the services management snap in is already open.

For Multiple server setup

Create copy of the <Jboss>\bin\service.bat into another file with name ‘service_App1.bat’, ‘service_App2.bat’ and so on.

Configuration for first server.

1. Edit File service_App1.bat & change following Properties.
   1. Search for
      set "SVCNAME=JBAS60SVC"
      Change it to
      set "SVCNAME=App1_Jboss"
   2. Search for
      set SVCDISP=JBoss Application Server 6.0
      Change it to
      set SVCDISP=App1 JBoss Server 6.0
   3. Search for
      set SVCDESC=JBoss Application Server 6.0.0 GA/Platform: Windows %PROCESSOR_ARCHITECTURE%
      Change it to
      set SVCDESC=App1 JBoss Server 6.0.0 GA/Platform: Windows %PROCESSOR_ARCHITECTURE%
   4. Search for
      jbosssvc.exe -imwdc %SVCNAME% "%DIRNAME%" "%SVCDISP%" "%SVCDESC%" service.bat
      Change it to
      jbosssvc.exe -imwdc %SVCNAME% "%DIRNAME%" "%SVCDISP%" "%SVCDESC%" service1_App.bat
   5. Search for (this will appear twice)
      call run.bat < .r.lock >> run.log 2>&1
      Change it to (Change both instance)
      call App1.bat -c App -b 0.0.0.0 < .r.lock 2>&1
      If the server is running on specific IP then change it with following
      call App1.bat -c App -b <IP_ADDRESS> < .r.lock 2>&1
   6. Search for (this will appear twice)
      call shutdown -S < .s.lock >> shutdown.log 2>&1
      Change it to (Change both instance)
      call shutdown --host=127.0.0.1 --port=1090 -S < .s.lock >> shutdown.log 2>&1
      If the server is running on specific IP then change it with following
      call shutdown --host=<IP_ADDRESS> --port=1090 -S < .s.lock >> shutdown.log 2>&1
2. Edit file App.bat and verify if following properties are set to correct path, if not then set it to the correct path. If the property does not exist, then add the same.
   1. set JBOSS_HOME=D:\jboss6
   2. set JBOSS_CLASSPATH=%RUN_CLASSPATH%;D:\jboss6\server\App1\conf\properties;
   3. set "JAVA_HOME=D:\jdk1.6.0_25"

Install First Service

3. Open Command Prompt (Run as Administrator if applicable) and change directory to <jboss>\bin\
4. Execute following command.
   service_App1.bat install
5. Open Windows services, Service with the name “App1 JBoss Server 6.0”should be visible now. Try refresh if the services management snap in is already open.
6. Start service; wait for some time to get the service initialize.
7. View <Jboss_home>/server/App1/logs/boot.log and check for any errors.
8. Service installation is completed at this point.

Configuration for next servers

Follow steps 1 to 8 in previous section by replacing App1 with App2, wherever is applicable and go on by incrementing the number.

Configuring HTTPS on JBoss

Note: We are assuming here that Jboss6.1 and Jdk1.6.0.27 installed in D: drive and server is running on port 8080.

Step: 1. Creating keystore and private key

• Open a command prompt with run as administrator.
• Change directory to D:\jdk1.6.0_27\bin
• Enter below mentioned command with replacing <changeit> to your password as per your choice.

keytool -genkey -alias jbosskey -keypass <changeit> -keyalg RSA –validity 365 -keystore server.keystore

(Eg: keytool -genkey -alias jbosskey -keypass password -keyalg RSA –validity 365 -keystore server.keystore)

• Hit enter.
• Please enter password which you used in first command.
• Retype the same password again.
• What is your first and last name?
  Enter your jboss server DNS name or Alias name as per your choice.
• Enter organizational unit name.
• Enter organization name.
• Enter your city name.
• Enter state name.
• Enter country code.
• Enter Y to Agree.

• You will see “server.keystore” inside D:\jdk1.6.0_27\bin
• Please enter below command for verifying keystore.
  keytool -list -keystore server.keystore
• Enter the password.
• You will see output like below screen shot.
  

Generating and storing the Self sing certificate.

Note: replace <changeit> with your “server.keystore" password which you mentioned during "server.keystore" creation

• Enter following command.

keytool -export -alias jbosskey -keypass <changeit> -file server.crt -keystore server.keystore

Eg: keytool -export -alias jbosskey -keypass password -file server.crt -keystore server.keystore

• You will see “server.crt” inside D:\jdk1.6.0_27\bin

Note: replace <changeit> with your "server.keystore" password which you mentioned during "server.keystore" creation

• Enter following command.

keytool -import -alias jbosscert -keypass changeit -file server.crt -keystore server.keystore

Eg: keytool -import -alias jbosscert -keypass password -file server.crt -keystore server.keystore

Note:You receive a warning that it already exists in the keystore. Ignore it. It is because Java expects separate keystore and trustore files and we are using only one.

• Please enter below command for verifying keystore.
  keytool -list -keystore server.keystore
• Enter the password.
• You should see a TrustedCertEntry named jbosscert in the listing like in below screen shot.

• Copy “server.keystore” from D:\jdk1.6.0_27\bin to D:\jboss6.1\server\default\conf\ folder.

Step: 2. Enable HTTPS for JBoss

• Edit server.xml file using text editor(Recommended notepad++) D:\jboss6.1\server\default\deploy\jbossweb.sar folder
• Search for line SSL/TLS Connector and it will look like as below.

<!-- SSL/TLS Connector configuration using the admin devl guide keystore

<Connector protocol="HTTP/1.1" SSLEnabled="true"

port="${jboss.web.https.port}" address="${jboss.bind.address}"

scheme="https" secure="true" clientAuth="false"

keystoreFile="${jboss.server.home.dir}/conf/chap8.keystore"

keystorePass="rmi+ssl" sslProtocol = "TLS" />

-->

• Uncomment the line, just cut the --> arrow and paste it to first line like shown in below line and edit the code and enter keystore password which you used for creating keystore.

<!-- SSL/TLS Connector configuration using the admin devl guide keystore -->

<Connector protocol="HTTP/1.1" SSLEnabled="true"

port="443" address="${jboss.bind.address}"

scheme="https" secure="true" clientAuth="false"

keystoreFile="${jboss.server.home.dir}/conf/server.keystore"

keystorePass="password" sslProtocol="TLS" />

Step: 3. Enable Re direction from HTTP to HTTPS on JBoss

• Edit server.xml file using text editor(Recommended notepad++) D:\jboss6.1\server\swift\deploy\jbossweb.sar folder
• Search for line A HTTP/1.1 Connector on port 8080 and it will look like as below.

<Connector protocol="HTTP/1.1" port="${jboss.web.http.port}" address="${jboss.bind.address}"

redirectPort="${jboss.web.https.port}" />

• Edit the code as shown in below.

<Connector protocol="HTTP/1.1" port="8080" address="${jboss.bind.address}"

redirectPort="443" />

• Edit web.xml file using text editor(Recommended notepad++) D:\jboss6.1\server\default\deploy\jbossweb.sar folder

• Add the following code at bottom but before </web-app> as show in below.

/<security-constraint>

<web-resource-collection>

<web-resource-name>Protected Context</web-resource-name>

<url-pattern>/*</url-pattern>

</web-resource-collection>

<!-- auth-constraint goes here if you requre authentication -->

<user-data-constraint>

<transport-guarantee>CONFIDENTIAL</transport-guarantee>

</user-data-constraint>

</security-constraint>/

</web-app>

• Restart the Jboss Server; you are done with the configuration Swift server on SSL with redirection.

Installing a Certificate from a Certificate Authority

To obtain and install a Certificate from a Certificate Authority (like verisign.com, thawte.com or trustcenter.de), read the previous section and then follow these instructions:

Create a local Certificate Signing Request (CSR)

In order to obtain a Certificate from the Certificate Authority of your choice you have to create a so called Certificate Signing Request (CSR). That CSR will be used by the Certificate Authority to create a Certificate that will identify your website as "secure". To create a CSR follow these steps:

• Create a local Certificate (as described in the previous section):

·         keytool -genkey -alias tomcat -keyalg RSA \

    -keystore <your_keystore_filename>

Note: In some cases you will have to enter the domain of your website (i.e. www.myside.org) in the field "first- and lastname" in order to create a working Certificate.

• The CSR is then created with:

·         keytool -certreq -keyalg RSA -alias tomcat -file certreq.csr \

    -keystore <your_keystore_filename>

Now you have a file called certreq.csr that you can submit to the Certificate Authority (look at the documentation of the Certificate Authority website on how to do this). In return you get a Certificate.

Importing the Certificate

Now that you have your Certificate you can import it into you local keystore. First of all you have to import a so called Chain Certificate or Root Certificate into your keystore. After that you can proceed with importing your Certificate.

• Download a Chain Certificate from the Certificate Authority you obtained the Certificate from.
  For Verisign.com commercial certificates go to: http://www.verisign.com/support/install/intermediate.html
  For Verisign.com trial certificates go to: http://www.verisign.com/support/verisign-intermediate-ca/Trial_Secure_Server_Root/index.html
  For Trustcenter.de go to: http://www.trustcenter.de/certservices/cacerts/en/en.htm#server
  For Thawte.com go to: http://www.thawte.com/certs/trustmap.html
  
• Import the Chain Certificate into your keystore

·         keytool -import -alias root -keystore <your_keystore_filename> \

    -trustcacerts -file <filename_of_the_chain_certificate>

• And finally import your new Certificate

·         keytool -import -alias tomcat -keystore <your_keystore_filename> \

    -file <your_certificate_filename>