Apache hardening for Confluence - How can I disable http TRACE method

[Dick]

Hi, 
As I'm now responsible for the technical nuts and bolts for both Jira and Confluence, I've been tasked with hardening the Apache protocols. For those unfamiliar: it's all about disabling the http Trace method, so that attackers cannot receive information about the structure of our network (running both Jira and Confluence from our own datacenter).

So far, I've succeeded in hardening Apache for our Jira servers using this helpful Atlassian how-to page , for which I'm very grateful. 

But now for the hard part: The above solution doesn't seem to work for our Confluence (version 9.2.19, running on RHEL-9). Although Confluence starts up without any major errors, the service isn't approachable via web browser. This means I'm open to suggestions from you all regarding:

• Any helpful logs I could scan for valuable information (grep is my friend here)
• Any information as to why there is a difference here between Jira and Confluence, as we're talking about the sub-layer Apache, which should be the same for both
• Your own datacenter solution to this problem

Kind regards,
Dick

[Murray le Roux · Accepted solution]

Hi @Dick !

I believe the "Apache" here is the bundled Apache Tomcat inside both Jira and Confluence, and the Atlassian how-to you used for Jira is the web.xml security-constraint method. It ports straight to Confluence. only the file paths change, and that's likely why it didn't translate.

Same snippet you used on Jira, in Confluence's two web.xml files:

• <CONFLUENCE_INSTALL>/confluence/WEB-INF/web.xml — the application descriptor (Confluence's equivalent of Jira's atlassian-jira/WEB-INF/web.xml)
• <CONFLUENCE_INSTALL>/conf/web.xml — Tomcat's global descriptor (same name/role as Jira's conf/web.xml)

<security-constraint>
<web-resource-collection>
<web-resource-name>Restricted methods</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>TRACE</http-method>
</web-resource-collection>
</security-constraint>

(reuse your exact working Jira block so it's byte-for-byte identical.)

The reason confluence starts but isn't reachable is usually a sign of a web.xml that won't parse. Tomcat itself comes up, but the /confluence web-app context fails to load, so nothing answers.

Suggested logs to grep:

• <CONFLUENCE_INSTALL>/logs/catalina.out
• <CONFLUENCE_INSTALL>/logs/*access_log* - shows whether requests even reach Tomcat.
• <CONFLUENCE_HOME>/logs/atlassian-confluence.log — app-level startup.
  ss -tlnp | grep 8090 — confirm Tomcat is listening on Confluence's HTTP port (default 8090, vs Jira's 8080)

I would try restoring your backup of confluence/WEB-INF/web.xml, confirm the site returns, then re-apply the block and watch catalina.out as it restarts.

Hope this helps

[Murray le Roux]

heads up: this gets reset on each Confluence upgrade, so whatever process works is worth adding to your upgrade runbook

[Dick]

I'm fully aware of that. 

[Dick]

@Murray le Roux :

The key was in the comment between brackets:  it turned out that notepad embroydered my stored Jira solution with invisible mark-up that corrupted the xml. 

Direct bash to bash copy ensured that the (carefully typed-in Atlassian answer for Jira) also worked for Confluence. 

[Murray le Roux]

Ah makes sense! Glad you got it sorted!

[Darryl Lee]

Glad you found the fix @Dick !

[Darryl Lee]

Ah ok, let's try again, as my last attempt was totally wrong.

I will still say that hearing about Apache Tomcat always makes me think of this scene:

(Note: when old-timers like me hear "Apache" by itself, they think of the webserver. Your question is specifically about Tomcat.)

Anyways, onto the correct answer (maybe).

I couldn't find anything about disabling the TRACE method for Confluence, but I did find this guidance on adding security constraints to Confluence:

Step 5. Add a security constraint to redirect all URLs to HTTPS 

That describes how to redirect all HTTP requests to HTTPS, advising you to:

Edit the file at <CONFLUENCE_INSTALLATION>/confluence/WEB-INF/web.xml.

It also includes this tip:

 Confluence has two web.xml files. The other one is at <CONFLUENCE_INSTALLATION>/conf/web.xml. Please only add the security constraints to <CONFLUENCE_INSTALLATION>/confluence/WEB-INF/web.xml, as described above.

So... I would try removing the constraint from the conf/web.xml file and see if that resolves the issue.

(Note that this page describes terminating SSL with Tomcat itself, which is an outdated practice compared to using a reverse proxy.)