# Java 설치 여부 및 버전 확인
java -version

# 기존 openjdk-11 제거(없으면 생략)
apt-get remove openjdk*
apt-get autoremove --purge
apt-get autoclean

# openjdk-17 설치
apt-get install openjdk-17-jdk

# 3rabbitz 설치 볼륨
mkdir /3rabbitz
echo -e "\nn\np\n1\n\n\nt\n8e\nw" | fdisk /dev/sdb
vgcreate 3rabbitzvg /dev/sdb1
lvcreate -l +100%FREE -n 3rabbitzlv 3rabbitzvg
mkfs -t xfs /dev/mapper/3rabbitzvg-3rabbitzlv

# 3rabbitz 백업 볼륨
mkdir /3rabbitzbackup
echo -e "\nn\np\n1\n\n\nt\n8e\nw" | fdisk /dev/sdc
vgcreate 3rabbitzbackupvg /dev/sdc1
lvcreate -l +100%FREE -n 3rabbitzbackuplv 3rabbitzbackupvg
mkfs -t xfs /dev/mapper/3rabbitzbackupvg-3rabbitzbackuplv

# /etc/fstab 추가 및 마운트
grep "3rabbitzvg-3rabbitzlv" /etc/fstab > /dev/null
if [ $? -ne 0 ]
then
	echo "/dev/mapper/3rabbitzvg-3rabbitzlv /3rabbitz xfs defaults 0 0" >> /etc/fstab
fi

grep "3rabbitzbackupvg-3rabbitzbackuplv" /etc/fstab > /dev/null
if [ $? -ne 0 ]
then
	echo "/dev/mapper/3rabbitzbackupvg-3rabbitzbackuplv /3rabbitzbackup xfs defaults 0 0" >> /etc/fstab
fi

mount /3rabbitz
mount /3rabbitzbackup

sed -i 's/HISTSIZE=1000/HISTSIZE=100000/' /etc/profile
echo "" >> /etc/profile
echo "HISTTIMEFORMAT=\"%Y-%m-%d_%H:%M:%S \"" >> /etc/profile
echo "export HISTTIMEFORMAT" >> /etc/profile

Certbot 설치에 실패할 경우 다음 작업을 수행 후 진행하십시오.

• 방화벽 해제

• 80, 443 포트 미사용

# certbot, python3-certbot-apache 설치
apt install -y certbot python3-certbot-apache

# 인증서(apache용)만 발급
certbot certonly --apache -d docs.mantech.co.kr

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address (used for urgent renewal and security notices)
 (Enter 'c' to cancel): user@mantech.co.kr

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N
Account registered.
Requesting a certificate for docs.mantech.co.kr

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/docs.mantech.co.kr/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/docs.mantech.co.kr/privkey.pem
This certificate expires on 2022-08-24.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
...

ls /etc/letsencrypt/live/docs.mantech.co.kr/

# 갱신 가능 여부 확인
certbot renewcertonly --dryapache -run

# crontab으로 자동 갱신 설정
crontab -e

# 매월 1일 05시에 갱신
0 5 1 * * certbot renew

d docs.mantech.co.kr
...
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2

• 기존 데이터 복사로 인해 /3rabbitz/keystore.p12 파일이 있다면 삭제 후 인증서를 생성하십시오.

• 이때 입력한 비밀번호를 기억하여 이후에 server.xml 파일 설정 시 입력하십시오.

keytool -genkey -alias tomcat -storetype PKCS12 -keyalg RSA -keysize 2048 -keystore keystore.p12 -validity 3650

새 비밀번호 다시 입력: (예:roqkf2xla)
이름과 성을 입력하십시오.
  [Unknown]:  
조직 단위 이름을 입력하십시오.
  [Unknown]:  
조직 이름을 입력하십시오.
  [Unknown]:  
구/군/시 이름을 입력하십시오?
  [Unknown]:  
시/도 이름을 입력하십시오.
  [Unknown]:  
이 조직의 두 자리 국가 코드를 입력하십시오.
  [Unknown]:  
CN=Unknown, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown이(가) 맞습니까?
  [아니오]:  yes

openssl pkcs12 -export -in /etc/letsencrypt/live/docs.mantech.co.kr/fullchain.pem -inkey /etc/letsencrypt/live/docs.mantech.co.kr/privkey.pem -out /3rabbitz/keystore.p12 -name tomcat -CAfile /etc/letsencrypt/live/docs.mantech.co.kr/chain.pem -caname root

vi /3rabbitz/tomcat/conf/server.xml

...

<Server port="5791" shutdown="SHUTDOWN">

  <Service name="Catalina">
          <!--
    <Connector port="8009" protocol="AJP/1.3" address="0.0.0.0" secretRequired="false" redirectPort="8443" URIEncoding="UTF-8" maxPostSize="-1" Server="3Rabbitz" />
    <Connector port="1975" protocol="HTTP/1.1"
          connectionTimeout="20000" redirectPort="8443" URIEncoding="UTF-8" maxPostSize="-1" Server="3Rabbitz" />
          -->

    <Connector port="80" protocol="HTTP/1.1" relaxedQueryChars="^`\|{}[]"
    connectionTimeout="20000" redirectPort="443" URIEncoding="UTF-8"
    maxPostSize="-1" Server="3Rabbitz" />

    <Connector port="443" protocol="HTTP/1.1" relaxedQueryChars="^`\|{}[]"
    connectionTimeout="20000" URIEncoding="UTF-8"
    maxPostSize="-1" Server="3Rabbitz"
    SSLEnabled="true" scheme="https" secure="true"
    clientAuth="false" sslProtocol="TLS"
            keystoreFile="/3rabbitz/keystore.p12"
    keystorePass="roqkf2xla"
    keystoreType="PKCS12" />

    <Engine name="Catalina" defaultHost="localhost">
      <Host name="localhost" appBase="/" unpackWARs="true"
        autoDeploy="false" deployOnStartup="false" createDirs="false">
...

vi /3rabbitz/tomcat/conf/web.xml

...
<web-app>
...
 <security-constraint>
        <web-resource-collection>
            <web-resource-name>All Requests</web-resource-name>
            <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>
    </security-constraint>
</web-app>

서버 변경 시, 기존 서버에 관련 설정이 적용되어 있어 아래 작업 없이 관련 데이터만 이관합니다.