对于 Tomcat 8，Httpd 返回503服务使用 mod_xy 不可用

我正在尝试将 Tomcat 与 Apache 集成 http://localhost/myapp呼叫 http://localhost:8080

我遵循了这个指南: http://tomcat.apache.org/tomcat-8.0-doc/proxy-howto.html

我的 httpd.conf是这样的:

Include conf.modules.d/*.conf
LoadModule proxy_module  modules/mod_proxy.so


ProxyPass         /myapp  http://localhost:8080 retry=0 timeout=5
ProxyPassReverse  /myapp  http://localhost:8080

Apache-tomcat 中的 server.xml 如下所示:

<Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8443" proxyPort="80" />

现在，当我尝试使用 url http://localhost/myapp时，它会给出 503 Service Unavailable错误。

Tomcat 和 Apache 都已经启动并运行。

是否存在文件权限问题？

对于 tomcat，用户和组是 root/root，对于 httpd，用户和组是 apache/apache

是我错过了什么，还是我做错了什么？

Httpd 版本是2.4.6，Tomcat 版本是8.0

Httpd 错误日志:

[proxy:error] [pid 19905] (13)Permission denied: AH00957: HTTP: attempt to connect to 127.0.0.1:8080 (localhost) failed


[proxy:error] [pid 19905] AH00959: ap_proxy_connect_backend disabling worker for (localhost) for 0s


[proxy_http:error] [pid 19905] [client ::1:51615] AH01114: HTTP: failed to make connection to backend: localhost

解决了！

答案就在这里: http://sysadminsjourney.com/content/2010/02/01/apache-modproxy-error-13permission-denied-error-rhel/

150062 次浏览
小开

(Answered by the OP in a question edit. Converted to a community wiki answer. See Question with no answers, but issue solved in the comments (or extended in chat) )

The OP wrote:

The answer is here: http://sysadminsjourney.com/content/2010/02/01/apache-modproxy-error-13permission-denied-error-rhel/

Which is a link to a blog that explains:

SELinux on RHEL/CentOS by default ships so that httpd processes cannot initiate outbound connections, which is just what mod_proxy attempts to do.

If this is the problem, it can be solved by running:

 /usr/sbin/setsebool -P httpd_can_network_connect 1

And for a more definitive source of information, see https://wiki.apache.org/httpd/13PermissionDenied

小开

this worked for me by editing my *.conf file in apache:

ProxyRequests     Off
ProxyPreserveHost On
RewriteEngine On


<Proxy http://localhost:8123>
Order deny,allow
Allow from all
</Proxy>


ProxyPass         /node  http://localhost:8123
ProxyPassReverse  /node  http://localhost:8123
小开

On CentOS Linux release 7.5.1804, we were able to make this work by editing /etc/selinux/config and changing the setting of SELINUX like so:

SELINUX=disabled
小开

Resolve issue Immediate, It's related to internal security

We, SnippetBucket.com working for enterprise linux RedHat, found httpd server don't allow proxy to run, neither localhost or 127.0.0.1, nor any other external domain.

As investigate in server log found

[error] (13)Permission denied: proxy: AJP: attempt to connect to
10.x.x.x:8069 (virtualhost.virtualdomain.com) failed

Audit log found similar port issue

type=AVC msg=audit(1265039669.305:14): avc:  denied  { name_connect } for  pid=4343 comm="httpd" dest=8069
scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket

Due to internal default security of linux, this cause, now to fix (temporary)

 /usr/sbin/setsebool httpd_can_network_connect 1

Resolve Permanent Issue

/usr/sbin/setsebool -P httpd_can_network_connect 1

提交答案