Wonderful to hear, Phillip. Thanks for the confirmation and for marking the answer. I have a few more related thoughts given your confirmation of things.
1) There's one more little thing you could do to help future readers who may find this: can you indicate where the folder was that held that mod_jk.log? As I'd noted, it can vary, and that depends on the OS and Apache implementation. Your clarification of this will help especially those on MacOS.
In that same spirit, I see I had a couple of typos in my note, some of which were in the text of mine you copied. I've corrected both (I have moderator privilege here), and you'll see I also used the quote feature to better make your pull quote of mine stand out. (While that feature pulls in the entire reply, one can then edit it to leave only the portion meant to be quoted. Sharing that if it may help you or others going forward).
As always, just trying to help.
2) And FWIW, this challenge you hit actually arose as an issue starting in March 2020. It was Tomcat whose behavior changed, with respect to a vulnerability labeled "ghostcat", and since cf is built atop it by default, Adobe documented it in the technotes for updates to CF at the time, and I elaborated on and pointed to them then with a blog post of my own at the time. I share that now that we've confirmed that was the issue for you. It was a rather complicated mess, thus a long post (and update technote). And all subsequent updates to and versions of cf will continue to be affected, which is why you're hitting it even on a new install. Not everyone does. There are different variables affecting the ip address used to get the request from the web server to the Tomcat AJP connector.
3) Indeed, since your using apache I'll give you an heads up of one more related matter you may hit: if you suddenly get 403 (authorization) failures for reasons that again seem to "make no sense", there's one more change to that server.xml you may need to make, and it's also about that same ghostcat issue. And it's documented in both the technotes and my post. You'd add to that same AJP connector line:
allowedRequestAttributesPattern=".*"
(And note that these attributes in server.xml are case-sensitive/camel-cased, with the first letter lowercase as in the "address" none above.)
Should you just go ahead and add it? That's debatable. Tomcat was trying to protect us in blocking all but certain allowed "headers" coming into it from the web server. It's just that apache sends some they didn't expect. I've never heard that they corrected for that, so I'd wait and see if you need this. But again I wanted you to have heads-up.
4) So, phew: yes, it's all a LOT to take and take in. I've elaborated here because others will surely experience what you did, and they may find this post. Sadly, the "answer" is not always a simple one. An occasional summary like this can be helpful.
Good luck, otherwise, with the new MacBook. Oh, and please don't forget my request in point 1.🙂
/Charlie (troubleshooter, carehart.org)
1 Correct answer
8
Replies
AdChoices