john morrissey Insider

@Yoram Ayalon see the below if your security compliance doesn't mandate internal traffic be https seems the redirect will work for you and your crowd should still work just fine via http internally 

@Yoram Ayalon yes now that AWS ALB supports the redirect itself you don't really need to go through the complicated setup only unless your security compliance requires it which our mandates there's no possible way to access the system via http.

@Yoram Ayalon We also use the content switching of the ALB so people can't scan the IP and get through to our jira server as we blackhole all non FQDN traffic which is a bit of security through obscurity which opening up direct access to jira directly doesn't allow for. Also we have AWS WAF bound to the ALB for even…

Ok seems they updated this plugin on the 29th and now it's not falsely reporting the vulnerability so all is good now.

@Elliot Reiter I'm reaching out to tenable as their tenable.io scanner doesn't report it so I think it's a problem with the nessus pluging. We went as far as creating a user name jira with a very complex password which didn't help. I'll update you when I hear back from them.…

I forgot I posted here. Seems the offline reindex builds and cleans up the older index files but the online doesn't as they're in use so it's good to do the offline once and a while as it will clean up disk space also (at least did for us)

Yes if doing ssl offloading and you security policy allows for http between the ALB and App server I think you just need the redirect stuff in the server.xml. No need for the security constraints and rewriting I believe. Our security policy mandates back end encryption also be enforced that's why we need the security…

Ah ok the classic LB. Can you or would you consider changing to an ALB? It gives you more functionality where you can content switch based on FQDN to backend systems. You can also black hole anything just trying to access the IP address by sending it to a target group with no entries in it 

If the url<http://JIRA.ABC> or <https://JIRA.ABC> is the AWS ELB you can setup redirection on the ELB http listener configuration 

Ah ok I see it's from a few hours ago so answer is different now and will post

@Daniel Alonso though I'm not sure I trust that as my JIRA HOME > Cache > Indexes folder has a time stamp of the installation date though indexes inside have newer dates. I'm still piecing it together so will update here with what I find

@Daniel Alonso though you posted this a while ago I figured I'd share the below Current Workaround * Proceed to JIRA HOME > Cache > Indexes * Check when last this folder was modified. This is from: https://jira.atlassian.com/browse/JRASERVER-44163

Previously till about a month ago AWS didn't support redirecting http to https at their ALB loadbalancer. I submitted an enhancement to allow the ALB to do the redirect. This solution was to perform the redirect via jira web server which was rewriting all the urls. Now that AWS can do the redirect technically you don't…

@SC DevOps they actually do have ip addresses though AWS support can't see them. We found the exact ip addresses by looking at the tomcat access logs. With that said they do change if they fail over (AWS support couldn't tell me what would cause a failover) so it's not really the best method. In the end our issue is we…

@Jeevan Desarda or @anyone do you know if the plugin available from MS will work with Jira installed on a *nix machine? I'm trying to upload it but it keeps failing. The MS doc states Jira has to be installed on a 64bit Windows OS but figured I'd ask if you had any experience

hum for "below the <web-app> </web-app>" technically it's between that as the </web-app> is at the very bottom of the file. I modified the instructions a bit ago so I think that should work and if people comment I get notified and am happy to help out so we'll see how it goes. Glad it's working for you and it helped you out

ok I modified the original post let me know if it's clear now.

@Rick Carini are you all set?

@Rick Cariniyes that is incorrect you need to close the <web-app parameter with a > so in your example the > should be after the metadata-complete="true" like "metadata-complete="true">" to close out the opening <web-app As an example all configurations need to open and close for the setting to take like the below…

glad it helped

we use ALB for jira as we use a MFA jumpbox for ssh connections as for ports 80/443 as the above redirects 80 to 443

Branden, Yes we were seeing an internal server error page which a restart of jira doesn't fix it. We have to revert the db connection to use non ssl to get jira to come up. The strange thing is the db is connected just fine. Anyway after a lot of testing duplicating the exact environment we couldn't get the issue to occur…

John our issue was simple our EC2 instance don't have public IP addresses by design. Without a public IP or a NAT gateway they couldn't get to the external AWS SES server. We spun up a NAT gatway and all worked well with the below SMTP port 587 tls check 

Ok I'll give it a try I also found EC2 instances (AWS Linux AMI) have their MTU set pretty high (6500 ish) which on another thread they recommended changing it to the default ethernet of 1500. I'll update you if I find anything on this.

Thanks Shannon just trying to setup your product correctly in AWS 

Shannon, I appreciate your help but want to respond to your comments. "we may not even be using RDS specifically for our database setup" - Your documentation for your AWS template states otherwise though you give no guidance on this in your documentation (e.g., what RDS version, and any custom configuration) please see…

John did you ever get jira working with SES SMTP?

Yes I know how to connect to the DB I'd like to work with somone on the rds parameter group as your cloud must be using a modified group which I just need to know the settings. A screen shot of the parameter group or script for the rds instance creation should be all I need. Please have someone give me a call so we can…

it appears your cloud platfrom is running aws rds with postgresql is there someone there that can help us with what parameter group settings we need to change? https://aws.amazon.com/quickstart/architecture/jira/

ok interesting and what I was hoping for can you see if they run on rds postgresql which if so (hopefully) can we get their db parameter group info? Seems your hosting group would be the experts and may the AWS engineer was just not familiar with what I was asking. They can contact me directly if there's any info you don't…