How to install Tomcat 6 on RHEL 6 or CentOS 6

Here are some steps to install Tomcat 6 on Red Hat 6 (or CentOS 6).


First we are going to prepare the repository:

yum install yum-priorities
rpm -Uvh
rpm -Uvh
rpm -Uvh

Next we will install Java and Tomcat 6:

yum -y install java
yum -y install tomcat6 tomcat6-webapps tomcat6-admin-webapps

Finally we can launch Tomcat 6:

service tomcat6 start

To connect to Tomcat, just browse to port 8080 on the server, for example:

Here are a couple of diagnostic commands to test that Tomcat is running:

# service tomcat6 status
tomcat6 (pid 17318) is running... [ OK ]
# netstat -nlp|grep 800
tcp 0 0* LISTEN xxxxx/java
tcp 0 0* LISTEN xxxxx/java
# netstat -nlp|grep 8080
tcp 0 0* LISTEN xxxxx/java

File Structure

The Red Hat file structure is different than the default file structure Tomcat 6 has when installing from source. Here is the file structure that is used when installing with this method:

/etc/tomcat6 (this is where the main tomcat config files reside)
/var/lib/tomcat6 (this is where you will add and/or change most of your files)

Here is an article that explains how to add support for JConsole debugging and/or monitoring to Tomcat:

Install Packages on OpenBSD 4.x and OpenBSD 5.x

To install binary packages on OpenBSD, the package manager needs to have the correct download URL.  This URL changes based on OpenBSD version and architecture.  Here is how to set it independently:

export PKG_PATH=$(uname -r)/packages/$(machine -a)/

Once that is done, the pkg_add command will work. In fact all pkg_* commands will work.

OpenVPN connects, but no ping

OpenVPN connection issue on Windows Vista and Windows 7



When connecting to an OpenVPN tunnel on Windows Vista or Windows 7, the OpenVPN GUI shows the connection as successful, but the protected network can not be reached.


Start OpenVPN as administrator. This is necessary even of the account launching OpenVPN is an administrator level account. If the OpenVPN GUI is already running, quit the application. Before launching OpenVPN GUI, right click, and select “Run As Administrator”.

There is a way to make this permanent in the Windows application properties:

Right click on the OpenVPN GUI icon, then click on Properties, and on the Compatibility tab. Tick the “Run this program as an administrator box.”

Installing a Secure Certificate on IBM Smart Business Server (VERDE)

At the time of this writing, the IBM Smart Business Server’s control panel doesn’t allow importing a secure certificate (SSL cert). Never-the-less it is possible to install a valid (CA signed) secure certificate from the command line. This article assumes that the reader is familiar with SSL and the basic SSL KEY, CSR, and CRT generation step. We are therefore picking up at the point where you have an SSL KEY as well as an SSL CRT. You will also need a machine that has openssl installed (any Linux or Mac box will do). In fact the smart business server itself has openssl installed, as well as keytools, so all the steps can be performed directly on the smart business server.

Please note that this is a draft document, and work in progress. At this time only the public facing websites have been successfully set up with a CA signed certificate.

  • The Apache configuration file for the setup wizard is:/etc/apache2/httpdWSW.conf
  • The Apache configuration file for the intranet is here:/etc/apache2/httpdInt.conf with the corresponding SSL configuration here: /etc/apache2/extra/httpdInt-ssl.conf
  • First copy the new key and cert (in the same file, key goes on top and then the cert) into /etc/opt/ibm/bbp/smartcontainer/httpdWSW.cert
  • (Optional, this step hasn’t been successfully tested, because a non-RFC compiant method is used.) To create an RFC compliant PKCS8 version of the key pair where the intranet config file is expecting it:
    cd /etc/opt/ibm/bbp/
    openssl pkcs8 -topk8 -inform PEM -nocrypt -in smartcontainer/httpdWSW.cert -out PKCS8.cert
  • Make sure the CA bundle is made available and properly reference in the above mentioned config files (cp path/to/sf_bundle.crt smartcontainer/)
  • Create a PKCS12 version of your certificate:
    openssl pkcs12 -export -chain -CAfile sf_bundle.crt -in '<your>.crt' -inkey '<your>.key' -out PKCS12.cert -name <name> -passout pass:111111
    (at the time of this writing, the default cert store password hard coded in the VERDE install is 111111)
  • Location of the Java SSL Keystore: /etc/opt/ibm/bbp/SSLkeystore
  • Location of the [SAFEv3] encription tool:/opt/ibm/bbp/saf/
  • Password retrieval command:/opt/ibm/bbp/saf/lib/security/manageAdminCreds -f get -a JavaKeyStore2048BitKey -i 1
  • Create a new keystore based on the PKCS#12 cert:
    keytool -importkeystore -destkeystore -srckeystore PKCS12.cert -srcstoretype PKCS12 -alias <common_name_of_SSL_cert>
  • Update the Keystore configuration reference in /opt/ibm/bbp/saf/cfg (use the password retrieved above).
  • Copy the PKCS#12 cert to the VERDE Tomcat cert store:
    cp PKCS12.cert /var/lib/verde/host.p12
    cp /var/lib/verde/host.p12 /usr/lib/verde/etc/host.p12
    (Make sure you save your previous copies of any file you modify.)

At this point, you have to restart the system, to make sure that all public services get the proper certificate loaded on boot. If you prefer, you can restart the services:

  • /etc/init.d/lwi restart
  • /etc/init.d/simpleAgent_d restart
  • restart the VERDE software from the web console


  • Many thanks to the bISV IBM support team

Sametime 8.5.1 Deployment

To deploy a Sametime environment with multiple levels of licensing, multiple Sametime servers with each respective license versions needed (Entry, Standard, etc.). The Sametime wiki has a number of useful resources to plan out a complex Sametime deployment:


And here are some documents that delve into the details:


Domino 8.5.2 Adding Email Aliases

Often times people need to receive email for multiple valid variation of their email addresses. On most email systems, these are called email aliases. IBM Domino has a slightly unusual way of allowing system administrators to define aliases:

  • Open the Domino Administrator Tool
  • On the People & Groups tab, select People
  • Edit the Person document of the person you would like to add an email alias to
  • Add the alternative email addresses to Short name/UserID like this:

    "UsedID [email protected]
    [email protected]
  • Save and close the Person document
  • Navigate to the Server... tab
  • Select the Server console
  • To enable the changes on the SMTP server, enter in the Domino Command: TELL ROUTER UPDATE CONFIG

Domino 8.5 SSL Key Import Into Keyring File

Domino Server SSL Key Import

By default, the SSL key order process in the Domino Administrator assumes that only single domain certificates are used. Hence, when you have a multi domain UCC or a wildcard certificate, it has to be loaded into the keyring (a.k.a. kyr file) outside of the Domino Administrator.

The basic overview of the process is this:

  • Create a kyr (keyring) file to hold the keys.
  • Create a p12 (PKCS#12) file with the certificate that needs to be added to the keyring.
  • Add the p12 (PKCS#12) file to the keyring.
  • Install the new keyring on the Domino Servers (mail, traveler, sametime, Quickr)

Domino Server PKCS#12 key generation and import

Create PKCS#12 from SSL KEY and CRT files

For this step I recommend to be on the Linux or AIX with openssl installed. Assuming that you have the certificate key, the CA issued certificate, and the certificate chains all in the same directory, you can run the following command to generate the p12 file:

openssl pkcs12 -export \
-in certificate-from-CA.crt \
-inkey certificate-key-file.key \
-certfile root-ca-bundle.crt \
-out certificate-in-pkcs12-format.p12

Add PKCS#12 to Domino Server Kyr Keyring File

For this step I recommend to be on the sametime server under Linux or AIX. In theory, this should work, but in practice, I found that the version 7 of the gsk tools doesn’t seem to be able to open kyr files. So you may need to skip ahead to the legacy Windows XP method, unless you can find the gsk5bas package on one of your older install media.

rpm -Uvh ${SAMETIME_CD_PATH}/SametimeEntryServer/GSKit/Linux/gsk7bas-7.0-4.28.i386.rpm
vi /opt/ibm/lotus/notes/latest/linux/ibm-jre/jre/lib/security/

Add last provider to list:

remove conflicting jar file:

mv /opt/ibm/lotus/notes/latest/linux/ibm-jre/jre/lib/ext/gskikm.jar /opt/ibm/lotus/notes/latest/linux/ibm-jre/jre/lib/ext/gskikm.removedjar-

set environment:

JAVA_HOME=/opt/ibm/lotus/notes/latest/linux/ibm-jre/jre export JAVA_HOME

Domino Server Required Utilities for SSL Key Import (legacy Windows XP method)

  • Download and install IKEYMAN.
  • Open the kyr file in gsk5.
  • Import the p12 cert.
  • Save the new kyr file.

Domino Server SSL Key Management References


For more information about Domino Server solutions, visit our collaboration section.

Linux Kernel Hangs During Boot

While rebooting a machine for example to apply a kernel update, it hangs. You try older kernels, and it hangs too. Not necessarily at the same spot. Here are some examples:

io scheduler cfq registered (default)
Real Time Clock Driver v1.12ac

These kernel hangs during boot are interestingly traceable to the USB keyboard. If you use a PS2 keyboard instead, the kernel may just continue booting. No comment.