nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Apache hardening for Confluence - How can I disable http TRACE method

Dick

Hi,
As I'm now responsible for the technical nuts and bolts for both Jira and Confluence, I've been tasked with hardening the Apache protocols. For those unfamiliar: it's all about disabling the http Trace method, so that attackers cannot receive information about the structure of our network (running both Jira and Confluence from our own datacenter).

So far, I've succeeded in hardening Apache for our Jira servers using this helpful Atlassian how-to page , for which I'm very grateful.

But now for the hard part: The above solution doesn't seem to work for our Confluence (version 9.2.19, running on RHEL-9). Although Confluence starts up without any major errors, the service isn't approachable via web browser. This means I'm open to suggestions from you all regarding:

Any helpful logs I could scan for valuable information (grep is my friend here)
Any information as to why there is a difference here between Jira and Confluence, as we're talking about the sub-layer Apache, which should be the same for both
Your own datacenter solution to this problem

Kind regards,
Dick

Accepted answers

Murray le Roux_q8p69o

Hi @Dick !

I believe the "Apache" here is the bundled Apache Tomcat inside both Jira and Confluence, and the Atlassian how-to you used for Jira is the web.xml security-constraint method. It ports straight to Confluence. only the file paths change, and that's likely why it didn't translate.

Same snippet you used on Jira, in Confluence's two web.xml files:

<CONFLUENCE_INSTALL>/confluence/WEB-INF/web.xml — the application descriptor (Confluence's equivalent of Jira's atlassian-jira/WEB-INF/web.xml)
<CONFLUENCE_INSTALL>/conf/web.xml — Tomcat's global descriptor (same name/role as Jira's conf/web.xml)


<security-constraint>
<web-resource-collection>
<web-resource-name>Restricted methods</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>TRACE</http-method>
</web-resource-collection>
</security-constraint>

(reuse your exact working Jira block so it's byte-for-byte identical.)

The reason confluence starts but isn't reachable is usually a sign of a web.xml that won't parse. Tomcat itself comes up, but the /confluence web-app context fails to load, so nothing answers.

Suggested logs to grep:

<CONFLUENCE_INSTALL>/logs/catalina.out
<CONFLUENCE_INSTALL>/logs/*access_log* - shows whether requests even reach Tomcat.
<CONFLUENCE_HOME>/logs/atlassian-confluence.log — app-level startup.
ss -tlnp | grep 8090 — confirm Tomcat is listening on Confluence's HTTP port (default 8090, vs Jira's 8080)

I would try restoring your backup of confluence/WEB-INF/web.xml, confirm the site returns, then re-apply the block and watch catalina.out as it restarts.

Hope this helps

All comments

Murray le Roux_q8p69o

Hi @Dick !

Same snippet you used on Jira, in Confluence's two web.xml files:

<CONFLUENCE_INSTALL>/confluence/WEB-INF/web.xml — the application descriptor (Confluence's equivalent of Jira's atlassian-jira/WEB-INF/web.xml)
<CONFLUENCE_INSTALL>/conf/web.xml — Tomcat's global descriptor (same name/role as Jira's conf/web.xml)


<security-constraint>
<web-resource-collection>
<web-resource-name>Restricted methods</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>TRACE</http-method>
</web-resource-collection>
</security-constraint>

(reuse your exact working Jira block so it's byte-for-byte identical.)

The reason confluence starts but isn't reachable is usually a sign of a web.xml that won't parse. Tomcat itself comes up, but the /confluence web-app context fails to load, so nothing answers.

Suggested logs to grep:

<CONFLUENCE_INSTALL>/logs/catalina.out
<CONFLUENCE_INSTALL>/logs/*access_log* - shows whether requests even reach Tomcat.
<CONFLUENCE_HOME>/logs/atlassian-confluence.log — app-level startup.
ss -tlnp | grep 8090 — confirm Tomcat is listening on Confluence's HTTP port (default 8090, vs Jira's 8080)

I would try restoring your backup of confluence/WEB-INF/web.xml, confirm the site returns, then re-apply the block and watch catalina.out as it restarts.

Hope this helps

Darryl Lee

Ah ok, let's try again, as my last attempt was totally wrong.

I will still say that hearing about Apache Tomcat always makes me think of this scene:

giphy

(Note: when old-timers like me hear "Apache" by itself, they think of the webserver. Your question is specifically about Tomcat.)

Anyways, onto the correct answer (maybe).

I couldn't find anything about disabling the TRACE method for Confluence, but I did find this guidance on adding security constraints to Confluence:

Step 5. Add a security constraint to redirect all URLs to HTTPS

That describes how to redirect all HTTP requests to HTTPS, advising you to:

Edit the file at <CONFLUENCE_INSTALLATION>/confluence/WEB-INF/web.xml.

It also includes this tip:

Confluence has two web.xml files. The other one is at <CONFLUENCE_INSTALLATION>/conf/web.xml. Please only add the security constraints to <CONFLUENCE_INSTALLATION>/confluence/WEB-INF/web.xml, as described above.

So... I would try removing the constraint from the conf/web.xml file and see if that resolves the issue.

(Note that this page describes terminating SSL with Tomcat itself, which is an outdated practice compared to using a reverse proxy.)

Murray le Roux_q8p69o

heads up: this gets reset on each Confluence upgrade, so whatever process works is worth adding to your upgrade runbook

Dick

I'm fully aware of that.

Dick

@Murray le Roux :

The key was in the comment between brackets: it turned out that notepad embroydered my stored Jira solution with invisible mark-up that corrupted the xml.

Direct bash to bash copy ensured that the (carefully typed-in Atlassian answer for Jira) also worked for Confluence.

Murray le Roux_q8p69o

Ah makes sense! Glad you got it sorted!

Darryl Lee

Glad you found the fix @Dick !

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

apache

datacenter

trace

hardening