Post Installation Tasks

Hardening & performance ..

Post‑installation Hardening & Tuning

Optional settings you can apply after installation to harden Tomcat/Pentaho and tune behaviour:

Hide Tomcat Server header

By default, Tomcat sends a Server header exposing version information. You can override it to reduce information leakage.

1. Edit the Tomcat connector in server.xml.

sudo nano /opt/pentaho/server/pentaho-server/tomcat/conf/server.xml

1. Add or update the server attribute on the HTTP connector and (if used) AJP connector, then save.

<Connector port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           server=" "
           redirectPort="8443" />

1. Restart Pentaho Server.

sudo systemctl restart pentaho-server

Java Security Manager (deprecated/removed)

The legacy Java Security Manager is deprecated and not available on modern Java LTS versions (including Java 21). Do not use -security with Tomcat on Java 21. Prefer OS‑level hardening, least‑privilege users, network scoping, and container/AppArmor/SELinux policies as appropriate.

Change the web application context path

Change the context path if you do not want the application accessible at /pentaho.

1. Stop the Pentaho Server.

cd /opt/pentaho/server/pentaho-server
sudo ./stop-pentaho.sh

1. Edit context.xml.

sudo nano /opt/pentaho/server/pentaho-server/tomcat/webapps/pentaho/META-INF/context.xml

1. Update the context path.

<Context path="/company" docBase="webapps/company/" />

1. Rename the webapp folder to match the new context name.

sudo mv /opt/pentaho/server/pentaho-server/tomcat/webapps/pentaho \
        /opt/pentaho/server/pentaho-server/tomcat/webapps/company

1. Update the redirect in ROOT/index.jsp.

sudo nano /opt/pentaho/server/pentaho-server/tomcat/webapps/ROOT/index.jsp

Change the meta refresh to:

<meta http-equiv="refresh" content="0;URL=/company">

1. Update the server URL.

sudo nano /opt/pentaho/server/pentaho-server/pentaho-solutions/system/server.properties

fully-qualified-server-url=http://localhost:8080/company/

1. Start the server and test.

sudo ./start-pentaho.sh

Upgrades may overwrite deployed webapps. Reapply customizations after upgrades, or use reverse proxy path mapping instead.

Change to HTTPs

Default port is 8080.

1. Stop the Pentaho Server.

cd /opt/pentaho/server/pentaho-server
sudo ./stop-pentaho.sh

1. Change the connector port.

sudo nano /opt/pentaho/server/pentaho-server/tomcat/conf/server.xml

<Connector URIEncoding="UTF-8"
      port="8443"
      protocol="org.apache.coyote.http11.Http11NioProtocol"
      maxThreads="150"
      SSLEnabled="true"
      scheme="https"
      secure="true"
      clientAuth="false"
      sslProtocol="TLS"
      keystoreType="PKCS12"
      keystoreFile="/opt/pentaho/pentaho-server/tomcat/ssl/keystore.p12"
      keystorePass="changeit"
    />

1. Update the server URL.

sudo nano /opt/pentaho/server/pentaho-server/pentaho-solutions/system/server.properties

fully-qualified-server-url=http://localhost:8090/pentaho/

1. Start the server and verify.

sudo ./start-pentaho.sh
curl -I http://localhost:8090/pentaho/ | head -n 1

Change default HTTP port

Default port is 8080.

1. Stop the Pentaho Server.

cd /opt/pentaho/server/pentaho-server
sudo ./stop-pentaho.sh

1. Change the connector port.

sudo nano /opt/pentaho/server/pentaho-server/tomcat/conf/server.xml

<Connector URIEncoding="UTF-8"
           port="8090" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443"
           relaxedPathChars="[]|"
           relaxedQueryChars="^{}[]|&amp;"
           maxHttpHeaderSize="65536" />

1. Update the server URL.

sudo nano /opt/pentaho/server/pentaho-server/pentaho-solutions/system/server.properties

fully-qualified-server-url=http://localhost:8090/pentaho/

1. Start the server and verify.

sudo ./start-pentaho.sh
curl -I http://localhost:8090/pentaho/ | head -n 1

Harden or disable the Tomcat shutdown port

By default Tomcat listens on a local shutdown port (8005) for the SHUTDOWN command.

• Disable the port by setting port="-1", or

• Change both the port and the shutdown command to unpredictable values.

1. Edit the <Server> element in server.xml.

sudo nano /opt/pentaho/server/pentaho-server/tomcat/conf/server.xml

Examples:

<Server port="-1" shutdown="SHUTDOWN">

or

<Server port="18005" shutdown="My$tr0ngShutCmd">

1. Restart Pentaho Server.

sudo systemctl restart pentaho-server

Custom error pages (404, 403, 500)

Define application‑level error pages to avoid exposing defaults.

1. Create an error page in your webapp.

sudo tee /opt/pentaho/server/pentaho-server/tomcat/webapps/pentaho/error.jsp >/dev/null <<'EOF'
<html>
<head>
  <title>Error</title>
</head>
<body>
  <h1>Something went wrong</h1>
  <p>Please contact your administrator.</p>
</body>
</html>
EOF

1. Add error mappings in the webapp web.xml.

sudo nano /opt/pentaho/server/pentaho-server/tomcat/webapps/pentaho/WEB-INF/web.xml

<error-page>
  <error-code>404</error-code>
  <location>/error.jsp</location>
</error-page>
<error-page>
  <error-code>403</error-code>
  <location>/error.jsp</location>
</error-page>
<error-page>
  <error-code>500</error-code>
  <location>/error.jsp</location>
</error-page>

1. Restart the server and test.

Session timeout

Set a global session timeout for the application.

1. Edit the webapp web.xml.

sudo nano /opt/pentaho/server/pentaho-server/tomcat/webapps/pentaho/WEB-INF/web.xml

<session-config>
  <session-timeout>20</session-timeout>
</session-config>

Increase Karaf startup wait time

If server startup times out while Karaf installs features, increase the wait time.

1. Stop the server.

sudo systemctl stop pentaho-server

1. Edit server.properties.

sudo nano /opt/pentaho/server/pentaho-server/pentaho-solutions/system/server.properties

Uncomment or add:

# Time (ms) to wait for Karaf to install features before timing out
karafWaitForBoot=180000

1. Start the server.

sudo systemctl start pentaho-server

Remove sample data from the server

Remove evaluation samples before moving to production.

1. Stop the server.

sudo systemctl stop pentaho-server

1. Delete the samples.zip from default content (path may vary by version).

sudo rm -f /opt/pentaho/server/pentaho-server/pentaho-solutions/system/default-content/samples.zip || true

1. Edit the webapp web.xml and remove the HSQLDB sample definitions and the SystemStatusFilter (dev‑only).

sudo nano /opt/pentaho/server/pentaho-server/tomcat/webapps/pentaho/WEB-INF/web.xml

Remove blocks similar to:

<context-param>
  <param-name>hsqldb-databases</param-name>
  <param-value>sampledata@../../data/hsqldb/sampledata</param-value>
</context-param>

<listener>
  <listener-class>org.pentaho.platform.web.http.context.HsqldbStartupListener</listener-class>
</listener>

<filter>
  <filter-name>SystemStatusFilter</filter-name>
  <filter-class>com.pentaho.ui.servlet.SystemStatusFilter</filter-class>
</filter>

1. Optionally remove the server data/ directory if only sample content was used (verify your environment before deleting).

sudo rm -rf /opt/pentaho/server/pentaho-server/data || true

1. Start the server and remove sample folders via PUC (Browse Files → Public → Move to Trash).

sudo systemctl start pentaho-server

Hide Home perspective widgets

Hide Getting Started and other widgets from the PUC Home page.

1. Stop the server.

sudo systemctl stop pentaho-server

1. Edit the Home perspective configuration.

sudo nano /opt/pentaho/server/pentaho-server/tomcat/webapps/pentaho/mantle/home/properties/config.properties

Add or update:

disabled-widgets=getting-started,recents,favorites

1. Start the server and log in to verify.

sudo systemctl start pentaho-server

Turn off autocomplete on the login page (advanced)

Changing vendor JSPs may be overwritten on upgrade. Prefer SSO or reverse proxy controls. If you must, edit the login JSP.

1. Stop the server.

sudo systemctl stop pentaho-server

1. Edit PUCLogin.jsp.

sudo nano /opt/pentaho/server/pentaho-server/tomcat/webapps/pentaho/jsp/PUCLogin.jsp

1. Set autocomplete to off for user/password inputs.

<input id="j_username" name="j_username" type="text" autocomplete="off">
<input id="j_password" name="j_password" type="password" autocomplete="off">

1. Start the server.

sudo systemctl start pentaho-server

Increase CSV upload limits

Adjust upload limits and (optionally) staging database.

1. Edit pentaho.xml.

sudo nano /opt/pentaho/server/pentaho-server/pentaho-solutions/system/pentaho.xml

<file-upload-defaults>
  <relative-path>/system/metadata/csvfiles/</relative-path>
  <max-file-limit>10000000</max-file-limit>
  <max-folder-limit>500000000</max-folder-limit>
</file-upload-defaults>

1. Change the staging database for CSV files (optional) in data-access/settings.xml.

sudo nano /opt/pentaho/server/pentaho-server/pentaho-solutions/system/data-access/settings.xml

<!-- settings for Agile Data Access -->
<data-access-staging-jndi>hibernate</data-access-staging-jndi>

1. In PUC, go to Tools → Refresh System Settings, then restart PUC (or the server) to apply.

---