JIRA security: JIRA server runs over HTTPS

In order to encrypt JIRA login username & passsword instead of plain text in HTTP, configure JIRA Tomcat server (6.0) to run over HTTPS

1. Generate a private key

# login as root on JIRA Linux server.
[root@linux64-jira-server ~]#  id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
# su to jira running user
[jira@linux64-jira-server ~]$ su - jira
[jira@linux64-jira-server ~]$ $JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA
Enter keystore password:
Re-enter new password:
What is your first and last name?
  [Unknown]:  linux64-jira-server.domain.com
What is the name of your organizational unit?
  [Unknown]:  my_unit
What is the name of your organization?
  [Unknown]:  my_org
What is the name of your City or Locality?
  [Unknown]:  my_city
What is the name of your State or Province?
  [Unknown]:  my_state
What is the two-letter country code for this unit?
  [Unknown]:  my_country
Is CN=linux64-jira-server.domain.com, OU=my_unit, O=my_org, L=my_city, ST=my_state, C=my_country correct?
  [no]:  y
Enter key password for <tomcat>
        (RETURN if same as keystore password):
# Make sure .keystore existence under JIRA running user (jira) home
[jira@linux64-jira-server ~]$ id
uid=501(jira) gid=501(jira) groups=501(jira) 
[jira@linux64-jira-server ~]$ ls -al ~/.keystore
-rw-rw-r--  1 jira jira 1362 Jun  5  2012 .keystore

2. Generate a CSR (Certificate Signing Request)

[jira@linux64-jira-server ~]$ $JAVA_HOME/bin/keytool -certreq -keyalg RSA -alias tomcat -file certreq.csr -keystore /home/jira/.keystore

3. Submit certreq.csr to a certificate authority

Submit the generated certreq.csr to Certificate Authority for a certificate chain (DER encoded or Base 64 encoded), save it as certnew.p7b

4. Import the signed certificate into local keystore

[jira@linux64-jira-server ~]$ $JAVA_HOME/bin/keytool -importcert -alias tomcat -keystore /home/jira/.keystore -file /home/jira/certnew.p7b

5. Configure HTTPS in Tomcat

Insert below session into server.xml (Default is /opt/atlassian/jira/conf/server.xml) before </service> tag
<Connector port="8443" maxHttpHeaderSize="8192" SSLEnabled="true"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true" useBodyEncodingForURI="true"
acceptCount="100" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" />

6. Enable 8443 port from JIRA server firewall

system-config-securitylevel

7. Redirecting certain pages to HTTPS

Insert below session into web.xml (Default is /opt/atlassian/jira/atlassian-jira/WEB-INF/web.xml) before </web-app> tag <security-constraint>
<security-constraint>
   <web-resource-collection>
      <web-resource-name>all-except-attachments</web-resource-name>
      <url-pattern>*.jsp</url-pattern>
      <url-pattern>*.jspa</url-pattern>
      <url-pattern>/browse/*</url-pattern>
   </web-resource-collection>
   <user-data-constraint>
      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
   </user-data-constraint>
</security-constraint>

8. Debug JIRA Tomcat Server runs over HTTPS

[jira@linux64-jira-server ~]$ /opt/atlassian/jira/bin/start-jira.sh -fg

9. Restart JIRA Tomcat Server runs over HTTPS

[jira@linux64-jira-server ~]$  id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
[jira@linux64-jira-server ~]$ service jira stop
[jira@linux64-jira-server ~]$ service jira start

JIRA customization: email subject, description

Email notification subject with Status and Priority:

cd /opt/atlassian/jira/atlassian-jira/WEB-INF/classes/templates/email/subject

cat issueassigned.vm

$issue.statusObject.name $issue.priorityObject.name ($issue.key) $issue.summary

Customized Description:

Description field with template as below:

Symptoms :

--------------

Procedures :

--------------

               

Details:

---------

Steps:

cd /opt/atlassian/jira/atlassian-jira/WEB-INF/classes/templates/jira/issue/field

cp description-edit.vm org_bk_description-edit.vm

cat description-edit.vm

#customControlHeader ($action $field.id $i18n.getText($field.nameKey) $fieldLayoutItem.required $displayParameters $auiparams)

## setup some additional parameters

$!rendererParams.put("class", "long-field")

$!rendererParams.put("rows", "12")

$!rendererParams.put("wrap", "virtual")

#macro( setDescription )

Symptoms :

--------------

Procedures :

--------------

               

Details:

---------

#end

## let the renderer display the edit component

#if ($description=="" || !$description)

#set ($description = "#setDescription()")

#end

$rendererDescriptor.getEditVM($!description, $!issue.key, $!fieldLayoutItem.rendererType, $!field.id, $field.name, $rendererParams, false)

#customControlFooter ($action $field.id $fieldLayoutItem.getFieldDescription() $displayParameters $auiparams)

Restart JIRA service

service jira stop; service jira start:

JIRA: cli interface

Creating JIRA Issue using JIRA cli interface – a minimal effort solution, easy use and maintain

1.       JDK1.6 installed

2.       Download atlassian-cli-2.4.0-distribution.zip from atlassian website

3.       Unzip atlassian-cli-2.4.0-distribution.zip, such as C:\atlassian-cli-2.4.0

4.       Edit C:\atlassian-cli-2.4.0\jira.bat

from

      java -jar "%dirPath%"/lib/jira-cli-2.4.0.jar %*

               to

      java -jar "%dirPath%"/lib/jira-cli-2.4.0.jar --server http://<my_jira_server>:8080 --user <submitter_username> --password <submitter_password> %*

Example creating an issue in JIRA

Under Dos Prompt executing command as below :

C:\atlassian-cli-2.4.0\jira.bat --action createIssue --project "MY_JIRA_PROJECT_KEY" --type "defect" --summary "Created from cli" --priority "Priority 2" --affectsVersions "3.0.1" -–components "application"

Issue JIRATST-17 created with id 10705. URL: http://<my_jira_server>:8080/browse/MY_JIRA_PROJECT_KEY -17

Note:

Priority, affectsVersdions are mandatory fields

JIRA: duplicate JIRA database

# JIRA's XML backup utility to backup JIRA database in XML format

Administrator -> System -> Import & Export -> Backup System

# create a new latin1 database on a new database server to house JIRA's data

[root@linux64-jira-server ~]# mysql -u root -h linux64-jira-server
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 10
Server version: 5.5.25-community MySQL Community Server (GPL)
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> CREATE DATABASE latin1jiradb CHARACTER SET 'latin1';
Query OK, 1 row affected (0.00 sec)
mysql> CREATE USER 'latin1jira'@'linux64-jira-server' IDENTIFIED BY '********';
Query OK, 0 rows affected (0.00 sec)
mysql> GRANT ALL PRIVILEGES ON *.* TO 'latin1jira'@'linux64-jira-server';
Query OK, 0 rows affected (0.00 sec)
mysql> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.00 sec)
mysql> exit
Bye
[root@linux64-jira-server ~]# mysql --user=latin1jira --password=******** --database=latin1jiradb --host=linux64-jira-server
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 14
Server version: 5.5.25-community MySQL Community Server (GPL)
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> exit
Bye

# shutdown JIRA server

[root@linux64-jira-server ~]# service jira stop

# make a backup of JIRA HOME Directory (/var/atlassian/application-data/jira)

[root@linux64-jira-server jira]# cp -prf /var/atlassian/application-data/jira /var/atlassian/application-data/jira_backup

# remove previous dbconfig.xml from JIRA HOME Directory

[root@linux64-jira-server jira]# rm -f /var/atlassian/application-data/jira/dbconfig.xml

# restart JIRA server

[root@linux64-jira-server jira]# service jira start

# restart JIRA with JIRA Setup Wizard for configuring database connection

# click "import your existing data" link and restore you data from the XML backup created previously

JIRA: JIRA 4.4.4 on Red Hat 5

Install JIRA 4.4.4 (32bit) on Red Hat 5

# install MySQL Community Server 5.5 x86 64bit RPMs on Red Hat 5 server

rpm -Uvh /tmp/MySQL-shared-compat-5.5.25-1.rhel5.x86_64.rpm
rpm -Uvh /tmp/MySQL-server-community-5.5.25-1.rhel5.x86_64.rpm
rpm -Uvh /tmp/MySQL-client-community-5.5.25-1.rhel5.x86_64.rpm
/usr/bin/mysqladmin -u root password '********'

# configure MySQL DataBase for JIRA 4.4.4

mysql -u root -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 7
Server version: 5.5.25-community MySQL Community Server (GPL)


Type 'help;' or '\h' for help. Type '\c' to clear the buffer.


mysql> CREATE DATABASE jiradb CHARACTER SET 'utf8';
Query OK, 1 row affected (0.00 sec)


mysql> CREATE USER 'jira'@'linux64-jira-server' IDENTIFIED BY '********';
Query OK, 0 rows affected (0.00 sec)


Mysql> GRANT ALL PRIVILEGES ON *.* TO 'jira'@'linux64-jira-server';
Query OK, 0 rows affected (0.00 sec)


mysql> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.00 sec)


mysql> QUIT;

# verify jiradb creation

mysql --user=jira --password=******** --database=jiradb --host=linux64-jira-server
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 14
Server version: 5.5.25-community MySQL Community Server (GPL)
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> exit
Bye

# install atlassian-jira-4.4.4-x32.bin

./atlassian-jira-4.4.4-x32.bin
Unpacking JRE ...
Starting Installer ...


This will install JIRA 4.4.4 on your computer.
OK [o, Enter], Cancel [c]
o
If JIRA is already installed on this machine, please read the following information carefully.
Please choose between creating a new JIRA installation or upgrading an
existing JIRA installation.
Create a new JIRA installation. [1, Enter], Upgrade an existing JIRA installation. [2]
1


Where should JIRA 4.4.4 be installed?
[/opt/atlassian/jira]


Default location for JIRA data
[/var/atlassian/application-data/jira]


Configure which ports JIRA will use.
JIRA requires two TCP ports that are not being used by any other
applications on this machine. The HTTP port is where you will access JIRA
through your browser. The Control port is used to Startup and Shutdown JIRA.
Use default ports (HTTP: 8080, Control: 8005) - Recommended [1, Enter], Set custom value for HTTP and Control ports [2]
1
JIRA can be run in the background.
You may choose to run JIRA as a service, which means it will start
automatically whenever the computer restarts.
Install JIRA as Service?
Yes [y, Enter], No [n]
y


Extracting files ...




Please wait a few moments while JIRA starts up. Depending on your system this may take a few minutes.
Launching JIRA ...


Setup has finished installing JIRA 4.4.4 on your computer.
JIRA 4.4.4 can be accessed at http://localhost:8080
Finishing installation ...

# configure JIRA through http://linux64-jira-server

# Connect to MySQL

Specify the database connection: External
Database Type: MySQL
Hostname: linux64-jira-server
Port: 3306
Database: jiradb
Username: jira
Password: ********

# License

Application Title: MY JIRA
Mode: Private
Base URL: http://linux64-jira-server:8080
Server ID: ABCD-EFGH-IJKL_MNOP
License Key:

# Administrator Account

Username: admin
Password: ********
Confirm: ********
Full name: JIRA Administrator
Email: jira_admin@linux64.local.lab

# Email Notification

Email Notification: Enable
Name: Default SMTP Server
From address: jira_admin@linux64.local.lab
Email prefix: [JIRA]
Server Type: SMTP Host
Host Name: smtp.linux64.local.lab
Protocol: SMTP

Enterprise Linux - get /tmp size

#!/bin/sh
# This script uses to get the available /tmp size from /bin/df -h in GB

# Option 1:

# Normal case: use /bin/awk to get the available /tmp size from /bin/df -h
# if [[ `/bin/df -h /tmp | grep tmp` =~ "tmp" ]]; then
#    AVAILABLE_DISKSPACE=`/bin/df -h /tmp | /bin/grep tmp | /bin/awk '{print$4}'`
# else
#    AVAILABLE_DISKSPACE=`/bin/df -h /tmp | /bin/grep ^[[:space:]] | /bin/awk '{print$3}'`
# fi

# Option 2:

# No single quotes allowed case: use /bin/sed to get the available /tmp size from /bin/df -h
if [[ `/bin/df -h /tmp | grep tmp` =~ "tmp" ]]; then
   AVAILABLE_DISKSPACE=`/bin/df -h /tmp | /bin/grep tmp | /bin/sed -e "s/^\S*\s*\S*\s*\S*\s*\(\S*\)\s*\S*\s*\S*$/\1/g"`
else
   AVAILABLE_DISKSPACE=`/bin/df -h /tmp | /bin/grep ^[[:space:]] | /bin/sed -e "s/^\s*\S*\s*\S*\s*\(\S*\)\s*\S*\s*\S*$/\1/g"`
fi
if [[ ${AVAILABLE_DISKSPACE} =~ ".*K$" ]]; then
   TMP_SIZE_IN_GB=${AVAILABLE_DISKSPACE%K}
   TMP_SIZE_IN_GB=(${TMP_SIZE_IN_GB} / 1048576)
elif [[ ${AVAILABLE_DISKSPACE} =~ ".*M$" ]]; then
   TMP_SIZE_IN_GB=${AVAILABLE_DISKSPACE%M}
   TMP_SIZE_IN_GB=(${TMP_SIZE_IN_GB} / 1024)
elif [[ ${AVAILABLE_DISKSPACE} =~ ".*G$" ]]; then
   TMP_SIZE_IN_GB=${AVAILABLE_DISKSPACE%G}
elif [[ ${AVAILABLE_DISKSPACE} =~ ".*T$" ]]; then
   TMP_SIZE_IN_GB=${AVAILABLE_DISKSPACE%T}
   TMP_SIZE_IN_GB=(${TMP_SIZE_IN_GB} * 1024)
fi
echo "Available /tmp disk space (GB): ${TMP_SIZE_IN_GB}"

MySQL: Community Server x86 64bit RPMs

Scenario:

Install MySQL Community Server 5.5 x86 64bit RPMs on Red Hat 5 server.



#!/bin/sh
TIME_STAMP=`date +%Y-%m-%d_%H_%M_%S`
TMPP_DIR=/tmp
MYSQL_USER=my_user
MYSQL_PASSWORD=my_password
FQDN_HOSTNAME=`hostname -f`

# make sure MySQL Community 5.5 x86 64bit RPMs existence

if [ -e "${TEMP_DIR}/MySQL-shared-5.5.25-1.rhel5.x86_64.rpm" ]; then
   /bin/chmod a+x ${TEMP_DIR}/MySQL-shared-5.5.25-1.rhel5.x86_64.rpm
else
   /bin/echo "${TEMP_DIR}/MySQL-shared-5.5.25-1.rhel5.x86_64.rpm doesn't exist" > "${MY_OUTPUT}"
   exit 1
fi
if [ -e "${TEMP_DIR}/MySQL-client-5.5.25-1.rhel5.x86_64.rpm" ]; then
   /bin/chmod a+x ${TEMP_DIR}/MySQL-client-5.5.25-1.rhel5.x86_64.rpm
else
   /bin/echo "${TEMP_DIR}/MySQL-client-5.5.25-1.rhel5.x86_64.rpm doesn't exist" > "${MY_OUTPUT}"
   exit 1
fi
if [ -e "${TEMP_DIR}/MySQL-server-5.5.25-1.rhel5.x86_64.rpm" ]; then
   /bin/chmod a+x ${TEMP_DIR}/MySQL-server-5.5.25-1.rhel5.x86_64.rpm
else
   /bin/echo "${TEMP_DIR}/MySQL-server-5.5.25-1.rhel5.x86_64.rpm" > "${MY_OUTPUT}"
   exit 1
fi
if [ -e "/var/lib/mysql" ]; then
   /bin/mv /var/lib/mysql /var/lib/mysql_${MY_TIME_STAMP_STRING}
fi
MY_OUTPUT="/tmp/mysql_rpm_install_output"
MY_MYSQL_RPMS="MySQL-shared MySQL-server MySQL-client"
MYSQL=/usr/bin/mysql
for i in `echo ${MY_MYSQL_RPMS}`
do
   /bin/rpm -Uvh --replacepkgs "${TEMP_DIR}/${i}*.rpm" > "${MY_OUTPUT}" 2>&1
   if [ "$?" != "0" ]; then
      /bin/cat "${MY_OUTPUT}"
      exit 1
   fi
done

# create MySQL user

$MYSQL -u root -e "CREATE USER '${MYSQL_USER}'@'${FQDN_HOST_NAME}' IDENTIFIED BY '${ FQDN_HOSTNAME }';" > "${MY_OUTPUT}" 2>&1
if [ "$?" != "0" ]; then
   /bin/cat "${MY_OUTPUT}"
   exit 1
fi

# grant MySQL user

$MYSQL -u root -e "GRANT ALL PRIVILEGES ON *.* TO '$MYSQL_USER'@'${FQDN_HOSTNAME}' IDENTIFIED BY '${MYSQL_PASSWORD}';" > "${MY_OUTPUT}" 2>&1
if [ "$?" != "0" ]; then
   /bin/cat "${MY_OUTPUT}"
   exit 1
fi

# flush privileges

$MYSQL -u root -e "FLUSH PRIVILEGES;"
if [ "$?" != "0" ]; then
   /bin/cat "${MY_OUTPUT}"
   exit 1
fi

# install completed

echo "INSTALLED SUCCESSFULLY"
if [ -e "${MY_OUTPUT}" ]; then
   /bin/rm -f "${MY_OUTPUT}"
fi
exit 0