Despite moving on to JBoss progressively I still share my findings, often they apply to other products too.
For a public facing server you want to reveal as little background information as possible. In Glassfish you can hide create custom 404 and 500 error pages (previous post), but you should also hide the server info that comes with the server header, easily revealed by a tool ike the Firefox plugin httpfox.
There are 2 crucial settings you must change:
- JVM setting for product name: -Dproduct.name=”My App Server”
- Remove the “XPowered By” flag
As result you will have a pretty generic response header
I could not believe it when I read this in my daily serving of IT news. But it is the truth, Oracle will stop the (commercial) support for Glassfish in 2016 !
I remember a) the full blown announcements during the take-over from SUN they would continue with Glassfish and b) people questioning it, the later should be right now. Ultimately, even Oracle saying they would continue with the community edition, means Glassfish will be dead, the core team will shrink and Glassfish becomes a hobby in order to maintain the reference EE implementation (to control the other players). They killed OpenOffice, OpenSolaris, Hudson CI (pretty much). I spent a lot of time with Glassfish and right now rolling it out to customers who actually expect commercial support, this back-stabs my efforts in the last few years being a Glassfish fan.
Dear Oracle, I will not continue with WebLogic Application Server (another closed product), but swing over to JBoss (for which I did some compatibility tests for our applications anyway the last 2 years)
So Long, and Thanks for All the (Glass)Fish !
I was offline for quite a while because shifting from one continent to another. But now regular posts should be rolling in again.
I am running a couple of instances in pre-production requirement mode and changed from a standard EBS volume to a IOPS volume for the DB instance or the volume with the DB files. I could not identify a reasonable increase of performance, maybe a misconception that IOPS volumes will boost performance, rather provide a defined and consistent random access I/O throughput. I must admit I did not use a value higher than 1000.
Some recommended reading:
I decided to return to a standard ESB volume for my database as its performance did not benefit from the IOPS type (the DB is not overly busy too).
You cant change type and size of an EBS volume on the fly.
Here the steps to achieve the same: Continue reading
Once you get into a production like stage with more data volume, more users, etc. you will find yourself pretty fast in the situation where Glassfish gets some hickups or slowness. An expected situation if you did not change the default parameters out of the box which are chosen to make Glassfish to run even on a small box.
We ran into some kind of concurrency problems with JDBC pools and thread where Glassfish appeared to be hanging. One approach is to create thread dumps for the JVM.
With Glassfish we have a few options:
Run jps which returns you the list of applications running a JVM, choose the PID and execute
jstack <PID> or jstack -F <PID> > td.log
Go the Glassfish_HOME/bin folder and execute
./asadmin --user admin generate-jvm-report --type=thread > threaddump.txt
- kill -3 <PID>
Supposed to create a dump in the default log folder of Glassfish. Doesnt work for me.
With the (or better more than 1) file at hand you can evaluate them by hand or use some of the tools around. I am still struggling to make the tool analyzing my dumps. They simply open the files like a editor.
Using linux (Ubuntu) instances on Amazon EC2 is a quite safe thing to do, at least measured by the security provided by the platform (security groups, ACL, physical security,..). I recommend reading their security site here. At the end of the day the server is only as secure as you configure it, if you choose to open all ports running services with their default configurations and password settings, Amazon can’t help you.
When connecting to a Ubuntu server with ssh you need to provide the keyfile (somekeyfile.pem) that you can download when creating the key pair.
This 2048 bit key is required to login as regular ubuntu user. What I dislike is the fact that this user can sudo all, so once someone manage to get into you user account, he has root access too. I recommend to set a password for the ubuntu user and change the sudoers configuration.
Change the password for user ubuntu
Open the sudoers include file
sudo vi /etc/suderos.d/90-cloudimg-ubuntu or sudo vi /etc/sudoers
change last line from
ubuntu ALL=(ALL) NOPASSWD:ALL
ubuntu ALL=(ALL) ALL
There are 2 crucial phases you want to look under the hood of your running Glassfish or inside the JVM underneath: Performance Tuning and Health Monitoring during production.
With JMX (Java Management Extensions, Wikipedia) at hand, there are a few options to choose from.
The graphical monitoring tool is great for local deployment, it allows you to connect to a JVM on the same host or a remote host. It creates line graphs for your for all relevant from the moment you connect, it is perfect to observe a server while you do some testing or other actions, though it does not record any values while you are not connected. I have a hard time to get it running on a remote server and I do not favour the ‘open’ approach (see previous blog entry) which allows anyone to access the JVM with the disabled authentication settings. I also had situations where the JVM was frozen and it was no longer possible to access the JVM for monitoring, here I would rather have snapshots before the problem started together with server.log.
Glassfish Rest Interface
Note: You need to enable the areas you want to monitor with the admin console (or the asadmin command line) because per default all are OFF. Continue reading
By default Glassfish listens to http on port 8080 and https on port 8181.
It is better to listen to the default ports 80 for http and 443 for https, usually you dont want the user to enter port numbers as part of the URL.
Even the Glassfish Admin Console allows to change the ports (Configurations/Server Config/Network Config/Network Listener), certain server OS such as Ubuntu do not allow non-root users (you should run Glassfish as separate user !) to ports below 1024. We can achieve this by port rerouting with the iptables command (under Ubuntu)
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8181
iptables-save -c > /etc/iptables.rules
iptables-restore < /etc/iptables.rules
iptables-restore < /etc/iptables.rules
Additionally you can get a proper SSL certificate to stop annoying the user with a no proper certificate warning. See previous tutorial here.
SSL Error (Chrome)
If you operate an enterprise application with a known URL to the users, unlike a regular website where the portal should be reached with regular http, I would completely disable regular http.