Coldfusion 10 on CentOS 6.3

Posted by Dark Training on November 1, 2012 tags: | coldfusion | centos | linux

Installing Coldfusion on CentOS 6.3 is pretty painless but there was one problem I saw.

If you are starting from a minimal CentOS install you need to install:
httpd
httpd-devel

After you download the bin file chmod it to 775 and then execute

chmod 755 ColdFusion_10_WWEJ_linux64.bin
./ColdFusion_10_WWEJ_linux64.bin

Install as normal / you see fit. A general rule of thumb is that for a production system, you don't install the documentation. I also went ahead and installed the httpd connection as well.

After you install, if you try to start httpd you will get the following error:

Starting httpd: httpd: Syntax error on line 1010 of /etc/httpd/conf/httpd.conf: Syntax error on line 2 of /etc/httpd/conf/mod_jk.conf: Cannot load /opt/coldfusion10/config/wsconfig/1/mod_jk.so into server: /opt/coldfusion10/config/wsconfig/1/mod_jk.so: failed to map segment from shared object: Permission denied

This is simply an Selinux issue, to fix that you have two options:

Bad way

setenforce 0
then changing /etc/selinux/conf to
"SELINUX=disabled" 

The RIGHT way

chcon --reference=/usr/sbin/httpd /opt/coldfusion10/config/wsconfig/1/mod_jk.so

SELinux is a powerful tool to protect your server and it always breaks my heart when websites just say "turn it off" to fix an issue. So, now you know how to do it right!

In one other instance, the above did not work, so here are some steps to figure out WHY. Again, please dont just disable SELinux.

First, grab the tool auit2why

yum install policycoreutils-python

Now lets see what is up:

grep httpd /var/log/audit/audit.log | audit2why

In my case I was seeing the following error in my httpd_log

[error] (13)Permission denied: mod_jk: could not open JkLog file /opt/coldfusion10/config/wsconfig/1/mod_jk.log

Looking at the output of audit2why, we can see that the issue is "Missing type enforcement (TE) allow rule."

So to fix that:

audit2allow -a
audit2allow -a -M httpd_t
semodule -i httpd_t.pp

And bingo, you should be up and running now!