Bug 1501499

Summary: tomcat listens to 0.0.0.0 for serving requests but just needs localhost
Product: Red Hat Satellite Reporter: Chris Duryee <cduryee>
Component: InstallationAssignee: satellite6-bugs <satellite6-bugs>
Status: CLOSED ERRATA QA Contact: Devendra Singh <desingh>
Severity: high Docs Contact:
Priority: high    
Version: 6.2.11CC: ahumbe, bkearney, bmidwood, byodlows, cdonnell, cduryee, chrobert, dsynk, egolov, ehelms, ekirby, ktordeur, mlinden, mmccune, nhall, pgervase, riehecky, rjerrido, swadeley, zhunting
Target Milestone: 6.8.0Keywords: FieldEngineering, PrioBumpField, Triaged
Target Release: Unused   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: foreman-installer-2.1.0-0 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-10-27 12:57:21 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1545876    

Description Chris Duryee 2017-10-12 16:21:31 UTC
Description of problem:

After an installation, tomcat is listening on 0.0.0.0 for the following ports defined in server.xml:

8080
8443
8009

The only service connecting to tomcat is katello, which runs on localhost. It would be better if tomcat was restricted to binding to 127.0.0.1. This is changed via server.xml.

Version-Release number of selected component (if applicable): 6.2.11

Comment 2 Chris Duryee 2017-10-12 16:44:59 UTC
sorry, i meant to say that katello only connects to candlepin on localhost, not that katello itself runs on localhost:)

Comment 4 Chris Roberts 2017-11-09 20:16:51 UTC
*** Bug 1188603 has been marked as a duplicate of this bug. ***

Comment 8 Craig Donnelly 2018-03-08 20:24:01 UTC
Currently showing the following on 6.3.0:

# netstat -tnpl | grep java
tcp6       0      0 :::8080                 :::*          LISTEN      11722/java          
tcp6       0      0 :::8443                 :::*          LISTEN      11722/java          
tcp6       0      0 127.0.0.1:8005          :::*          LISTEN      11722/java          
tcp6       0      0 :::8009                 :::*          LISTEN      11722/java

Comment 9 Peter Gervase 2018-03-12 16:26:24 UTC
Will this be configurable in custom-hiera?

Comment 10 Rich Jerrido 2018-03-12 19:59:01 UTC
(In reply to Peter Gervase from comment #9)
> Will this be configurable in custom-hiera?

Why would it need to be? End users aren't supposed to interact directly with Tomcat.

Comment 26 Devendra Singh 2020-06-17 10:09:18 UTC
Build Version: 6.8 Snap4

Status: Verified

Verification point:

# rpm -q foreman-installer-2.1.0-0.3.1.rc2.el7sat.noarch
foreman-installer-2.1.0-0.3.1.rc2.el7sat.noarch

# sudo netstat -lnp|grep java
tcp6       0      0 127.0.0.1:8443          :::*                    LISTEN      21575/java          
tcp6       0      0 127.0.0.1:8005          :::*                    LISTEN      21575/java          
tcp6       0      0 :::8140                 :::*                    LISTEN      21787/java          
tcp6       0      0 127.0.0.1:61613         :::*                    LISTEN      21575/java          
udp6       0      0 :::49220                :::*                                21575/java      

So here tomcat is communicating to candlepin via localhost(Katello).

One more thing the 8140 port is a puppet, not tomcat.

Comment 29 errata-xmlrpc 2020-10-27 12:57:21 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: Satellite 6.8 release), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:4366