Ansible Role: Jetty

An role which downloads and unpacks Jetty under /opt. Jetty user and group are also created if needed.

Requirements

None. Purpose of this role is to perform basic installation with security in mind.

Role Variables

Available variables are listed below, along with default values (see defaults/main.yml for details):

• jetty_version: 9.4.30.v20200611

• jetty_install: true

• jetty_force_install: false

• system_base: /opt - base directory where distribution package(s) will be installed to;

• jetty_home: /opt/jetty - defines the location of symlink name to the Jetty distribution with its libs, default modules and default XML files (typically start.jar, lib, etc), as well as Jetty user home directory. Important, it should be treated as a standard of truth and remain unmodified or changed;

• jetty_base: /var/lib/jetty - defines the location of a specific implementation of a Jetty server, its configuration, logs and web applications (typically start.d/*.ini files, logs and webapps); all changes or additions to your configuration should take place there;

• jetty_logs: /var/log/jetty

• jetty_dir_mode: 0750 - base and logs directory permissions;

• jetty_file_mode: 0640 - for files under base only;

• jetty_user_name: jetty

• jetty_group_name: jetty

• jetty_runtime_user: "{{ jetty_user_name }}" - for running a web application under a different user, in that case make sure it is part of jetty_group_name group;

• jetty_group_create: true

• jetty_user_create: true

• jetty_clean_old: false - whether to delete any other installed distribution except of the specified version; matching directories by {{system_base}}/jetty-distribution-*;

• jetty_demo_delete: true

• jetty_service_enabled: true

• jetty_service_name: "jetty"

• jetty_pid: {{ jetty_base }}/jetty.pid

• jetty_start: false

• jetty_start_log: {{ jetty_logs }}/jetty-start.log

• jetty_state: {{ jetty_base }}/jetty.state

• jetty_web_default - dictionary of modified and changeable settings in webdefault.xml; other changed setting is disabled directory listings (dirAllowed):

  • compiler: 11
  • development: true
  • log_verbosity: "WARNING"

• jetty_modules_configure: false - whether to configure any modules for start in Jetty base directory;

• jetty_modules - dictionary for configuring enabled modules, see examples in defaults/main.yml, as well as templates/start.d/ and module definitions for default values;

• jetty_modules_enabled:

  - connectionlimit
  - customrequestlog
  - deploy
  - ext
  - gzip
  - http
  - http2
  - http2c
  - https
  - inetaccess
  - jsp
  - jstl
  - lowresources
  - plus
  - resources
  - rewrite
  - security
  - server
  - ssl
  - threadlimit
  - websocket

• jetty_modules_config_overrides - some of the modules require extra configuration in XML which name might be not equal to module's name, e.g. ssl module but ssl-context.xml:

  jetty-inetaccess.xml
  jetty-rewrite.xml
  jetty-ssl-context.xml

• jetty_headers - see https://securityheaders.com for more information:

  Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate
  Expect-CT: enforce, max-age=86400
  Expires: 0
  Pragma: no-cache
  Referrer-Policy: same-origin
  Surrogate-Control: no-store
  X-Content-Type-Options: nosniff
  X-DNS-Prefetch-Control: off
  X-Download-Options: noopen
  X-Frame-Options: SAMEORIGIN
  X-XSS-Protection: 1; mode=block

• jetty_ssl_generate_cert: false - whether to generate a self-signed certificate;

• tls_cipher_suites - see https://www.ssllabs.com/ssltest and https://github.com/dev-sec/ssl-baseline for details:

  # TLS 1.3 cipher suites
  TLS_AES_256_GCM_SHA384
  # TLS 1.2 cipher suites
  TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
  TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

• tls_protocols: TLSv1.3 and TLSv1.2 only;

• java_options - note, default Java options are compatible with Java 11 or higher; modify the settings for Java 8:

  -server
  -Xms1g
  -Xmx1g
  -XX:MetaspaceSize=256m
  -XX:MaxMetaspaceSize=256m
  -XX:+UseContainerSupport
  -XX:MaxTenuringThreshold=1
  -XX:+UseAES
  -XX:+UseCompressedOops
  -Djava.security.egd=file:/dev/./urandom
  -Dhttps.protocols={{ tls_protocols | join(",") }}
  -XX:+DisableExplicitGC
  -XX:+UnlockExperimentalVMOptions
  -XX:+UseZGC
  -Xlog:gc:file={{ jetty_logs }}/jvm_gc.log:utctime,pid,level,tags:filecount=5,filesize=1024
  -XX:+PrintClassHistogram
  -XX:+HeapDumpOnOutOfMemoryError
  -XX:HeapDumpPath={{ jetty_logs }}/jvm_heapdump.hprof

Returned values

The following values are "returned" via set_fact for consecutive re-use:

• jetty_home
• jetty_version

Dependencies

While there is no direct dependencies for the role, it is understandable that all Jetty's requirements, i.e. Java runtime environment, must be satisfied. See official documentation for details.

Runtime settings

• if to generate a self-signed certificate is disabled then a valid keystore file must be provided inside jetty_base [sub-]folder.

Security

The following steps have been taken to secure and harden the service:

• disabled server version and XPoweredBy information in HTTP headers;
• HTTP/2, including h2c, has been enabled;
• HTTPS is limited to TLS v1.2 and 1.3 with strong ciphers only (see templates/etc/jetty-ssl-context.xml or corresponding variables above);
• TLS renegotiation has been disabled to prevent certain attacks;
• default HTTP headers have been modified as per above;
• strick order of ciphers is enforced;
• connection limit is set to 1500;
• GZIP compression is enabled;
• low resource monitor has been configured;
• thread limit per remote IP is set to 10;
• servlet standard security handling to the class path has been added;
• logging directory is set to {{ jetty_base }}/logs;
• server logging pattern is expanded with full RFC 3339 timestamp and other extra fields;
• request logging has been enabled in expanded NCSA format;
• as an example, HTTP header rewrite rule has been configured (jetty/etc/jetty-rewrite.xml) and disabled (jetty/start.d/rewrite.ini-disabled);
• enforced compliance:
  • RFC6265 - the HTTP Cookie and Set-Cookie header fields;
  • RFC7230 - HTTP/1.1;
  • RFC7578 - the multipart/form-data media type.

Example Playbook

- hosts: all
    roles:
      - role: CSCfi.jetty
        vars:
          jetty_modules_configure: true