Creating a DMZ installation

Our customer was on a standard Business Objects Apache 2.0.46/Tomcat 4.1.30 installation with JDK 1.4.2_03 on a single box. As this is on a single box,it is currently running as our Web server, Application server and Primary node in the cluster. We are running Windows 2000 Server SP4 with the repository on SQL Server 2000. We upgraded the Apache / Tomcat environment to Apache 2.0.54 and Tomcat 4.1.31 with j2sdk 1.4.2_09, as Apache states that this is a stable environment.

Our client has asked us to move then to a DMZ installation so as to allow their clients to login to WebI through the internet and view/run their reports themselves. They have acquired a new server to this end, and we re-installed the current box as the Web server inside the DMZ and installed the new, more powerful box, as the combination Application server/Primary node in their intranet.

Unfortunately, I cannot find any documentation on how to install and configure Apache and Tomcat on 2 different Windows 2000 servers, only installations on the same server, so that they can communicate with each other. We are running Windows 2000 Server SP4 on both servers, and what I would require is a step by step guide to installing and configuring Apache 2.0.54 on one server and Tomcat 4.1.31 on the other server and configuring both to communicate with each other in a DMZ installation.

I have found some documentation from BO that can guide me through a manual setup of the Primary node on the Application server once Apache and Tomcat can communicate with each other, but any input in this regard will also be appreciated.


BI Detective :south_africa: (BOB member since 2005-05-30)

You can start with deploying everything on 1 server (the server on intranet) Deploy WebI / Infoview-Tomcat / Infoview-Apache

Then move Apache and Tomcat to the DMZ machine. Start Tomcat / Apache on DMZ machine.

Things should work fine now.


shamit (BOB member since 2004-07-01)

Thanks for the quick reply, but now I have some questions.

According to the BO documentation on implementing a DMZ, you need to install Apache HTTP server on the web server and Tomcat on the Application server. This would mean that the 2 servers would need to communicate with each other over the LAN.

From what I understand from your post, you are suggesting that I install Apache and Tomcat on both machines. How will this help the 2 servers communicate with each other? I am a real novice when it comes to Apache and Tomcat, so bear with the stupid questions.


BI Detective :south_africa: (BOB member since 2005-05-30)

Yes this is a sensible choice. And good thing is it makes you job somewhat simpler… steps that I can think of are:

  1. Install Apache on DMZ machine (preferably from BO CD, will make support calls easier)
  2. Deploy Tomcat on machine that hosts WebI
  3. Deploy Apache on machine that hosts WebI
  4. Deploy Infoview as you normally would.

Configure APache on DMZ machine to work as “reverse” proxy to machine hosting Apache+Tomcat+WebI. Email me if you need detailes. For this,

You wil have to fight with httpd.conf file in Apache(On DMZ Machine)

This approach is bit different from the approach suggested by BO, but has one advantage. You will NOT have to worry about Apache->Tomcat issues. And applying hotfixes will be easier.


shamit (BOB member since 2004-07-01)

Hi everyone,

Shamit, as you seems to be experienced with reverse-proxy implementation. I’ve a question for you.

We are trying to build on our lab the following

Client -> firewall -> Apache 2 Reverse-proxy with SSL -> firewall -> BO Server 6.51 (Apache/Tomcat/BO Server).

using the out-of the box version for Apache/Tomcat.

Client is using https url on 443 port, but reverse-proxy is communicating with BO server on http usr on 8085 port.

We are trying to get:
Infoview, WEBI and BO 3-tiers mode working with this mode. I’m wondering how the rkey will be correctly generated if BO Server is not informed that it is behind reverse-proxy.

I’ve seen an old procedure with BO 5.1.x with siteMinder on WEB that you can use a variable name INFOVIEW_PORTAL. Do you know if it is still working ?

Or do you have a small proc to deploy BO Inforviw this way.

Thanks.

Newargus


newargus (BOB member since 2005-10-25)

I did not have to worry about Zabo while configuring a DMZ installation, so can’t say much on this.


shamit (BOB member since 2004-07-01)