Drupal 7 + IIS + MSSQL + Windows Authenticaiton

Installing Drupal 7 on Microsoft Windows 2008 with IIS 7 and MSSQL 2008 is not very easy.  It is even more difficult to set it up using Windows integrated authentication and URL rewrite (for Clean URL's).  I recently suffered through this process and documented it to spare others the same fate.

Key features of this setup:

1. Windows integrated authentication used for Drupal MSSQL database connectivity and serving Drupal web content.
2. URL rewrite rules to enabled Clean URLs in Drupal.
3. Special patch to enable MSSQL integrated Windows authentication during Drupal installation wizard.

If you have a choice, stick with Drupal on a LAMP stack.

HTH,

VVK

Minimal CentOS 6.2 Install

Similar to my past attempt to come up with a minimal CentOS 4.x install, I attempted to remove as many unnecessary RPM's from CentOS 6.2 install.  The result is a 183 package install.  You can find the list of minimal CentOS 6.2 RPM's here.

Cheers,
VVK

Apache Output Rewrite/Filter

When performing migration or code upgrades on public facing website, it is a common practice to test the changes in a development environment.   Occasionally, due to various reasons, you are forced to reference the development instance of the site using the public domain name.

For example, if the public facing site in question is www.example.com, and you want to setup a development instance in your lab, but want to be able to reference the site using the public DNS record, you have essentially two options: (1) Modify your DNS resolver (2) Modify your 'host' file.

The DNS option requires more effort but it is a better option if you have multiple developers, all using the same DNS server.

Host file trick is often used when you do not have a split-horizon DNS option or you do not control your DNS server.  Host file trick is the easiest and the most commonly used trick for such needs, however it comes with a bit of risk.  There is always the risk that a developer forgot to add the entry in his/her host file, and accidentally made changes to the production instance.  One simple trick to address such accidents is to modify the development site's header image or something similar.  However, in some applications which make extensive use of caching, sometimes this trick fails or leads to confusion.

Recently, I found myself on one such project (Drupal CMS) where we required not just a development instance, but also a QA instance.  To make matters worse, the developers needed to jump between production, development and QA instances multiple times a day.  I wanted to figure out a way to modify the web content to reflect the environment (dev or QA) without modifying the application PHP code.  Drupal has 3rd party extensions which can address this need, but I wanted to find a solution which was independent of the application (Drupal) and the server-side scripting technology (PHP).  I needed to make the modification at Apache level.

After doing some research, I quickly discovered Apache mod_ext_filter, a standard Apache module.  mod_ext_filter met all my criteria:

1. Web application independent
2. Server-side scripting technology independent
3. Flexible and simple
4. No 3rd party Apache modules or modifications to existing modules
5. Performance should be acceptable

If you know of a better way, than the one proposed below, to accomplish these goals, please post a comment.

From Apache mod_ext_filter page:

mod_ext_filter presents a simple and familiar programming model for filters. With this module, a program which reads from stdin and writes to stdout (i.e., a Unix-style filter command) can be a filter for Apache. This filtering mechanism is much slower than using a filter which is specially written for the Apache API and runs inside of the Apache server process, but it does have the following benefits:

• the programming model is much simpler

• any programming/scripting language can be used, provided that it allows the program to read from standard input and write to standard output

• existing programs can be used unmodified as Apache filters

To use mod_ext_filter, enable it in your httpd.conf file by adding the following line:

LoadModule setenvif_module modules/mod_setenvif.so

For my needs, my goal was to inject a line of text in the header and footer of each page to identify the environment (dev or QA).

Using ext_filter module, a custom stdout filter can be as simple as adding a call to 'sed' in the module configuration file (see "Using sed to replace text in the response" example).  The problem with this approach is that you need to restart Apache every time you made a change to your filter, which can get annoying very quickly.
A better approach is to call an external script, which can be written in any language of choice.  In addition to not having to restart Apache, this approach has the advantage of allowing for easier troubleshooting.

Here is my /etc/httpd/conf.d/ext_filter.conf calling an external filter.sh script.

ExtFilterDefine banner mode=output intype=text/html \
cmd="/bin/sh /var/www/filter.sh" 

<Location />
        SetOutputFilter banner
</Location> 

 In my filter.sh, I decided to perform a simple find/replace on the <body> and </body> tag.  To avoid any font and background color conflict issues, I decided to use uncommon colors for top and bottom banner.  Here is my filter.sh:

#!/bin/sh# Insert banner after and before the body opening and closing tags.
/bin/sed -r 's/(<body.*>$)/\1\<div align=center\>\<font size=4 color=#00FFFF\>Development Instance\<\/font\>\<div\>/1MI' | /bin/sed -r 's/\s*(<\/body.*>)/<div align=center\>\<font size=4 color=#00FF00\>Development Instance\<\/font\>\<div\&/1MI'

Notice, there are two sed find/replace happening, first one adds the header and second one adds the footer.  Here is a brief explanation of the script above:
-r: Use regular expressions

(<body.*>$)/\1: find the first instance of body tag.

\<div align=center\>\<font size=4 color=#00FFFF\>Development Instance\<\/font\>\<div\> : Fancy font work, with '\' for escaping special characters.

1MI: Stop after first find/replace, multi-line, and case insensitive


Escaping special characters makes the above script unreadable.  A better choice might be a Python script, especially if you plan to do something more elaborate, since Python can be compiled into object code.

The impact of page load performance is only noticeable on large pages using the proposed solution.  Beware, if the script has syntactic or other errors, the result is often a blank web page.  No amount of logging will reveal anything useful, and the only solution is the run the script independent of mod_ext_filter (e.g cat test.html | sh filter.sh ).

Hope this helps!
VVK

Minimal CentOS 4.8 Install

I am never satisfied with Red Hat's version of the "minimal" option during an install.  Their version of minimal install comes with unnecessary (IMHO) packages like bluez-*, various PPP and ISDN packages etc.

It is a pain to manually go through and "trim the fat", but I did.  Here is the list of RPM's required for a bare-bones RHEL/CentOS 4.8 install.  Note, to avoid breaking package dependences, I did not use --no-deps.  There are a few packages which could still be removed (mdadm, dmraid, logrotate etc.) but I find them useful, so I decided to keep them.

# rpm -qa | sort | uniq | wc -l
156


You can download the list of minimal RPM's from here.  If I find time, I'll also post the list of minimal RPM's for RHEL/CentOS 5.5.

HTH,
VVK

CLI Interactions w/SSL Enabled Website

I found it amusing that one of the major changes in the new PCI 2.0 regulation requires that any vulnerabilities with a CVSS score > 4 must be remediated (6.2).  It is amusing because what good does it do to require companies to perform vulnerability scanning, if remediation is not enforced, which was the case with the previous version of PCI DSS (11.2).

I digress.  Often I am required to confirm an identified vulnerability or validate a fix for a web server.  For example, checking to see if TRACK/TRACE is enabled/disabled or HOST header is set for name based virtual hosts.  These checks are easy to perform on a non-SSL web server (HTTP) using Telnet, but Telnet cannot be used against an SSL enabled web server (HTTPS).

# telnet ssl.somehost.com 443
Trying 10.10.3.93...
Connected to ssl.somehost.com.
Escape character is '^]'.
GET / HTTP/1.1
Connection closed by foreign host.

Telnet-SSL

The connection fails because telnet lacks SSL support.  You can verify this on Linux using the ‘ldd’ tool.

# ldd /usr/bin/telnet
        linux-gate.so.1 =>  (0xffffe000)
        libncurses.so.5 => /lib/libncurses.so.5 (0xb76c8000)
        libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0xb75da000)
        libm.so.6 => /lib/tls/i686/cmov/libm.so.6 (0xb75b3000)
        libgcc_s.so.1 => /lib/libgcc_s.so.1 (0xb75a4000)
        libc.so.6 => /lib/tls/i686/cmov/libc.so.6 (0xb744a000)
        libdl.so.2 => /lib/tls/i686/cmov/libdl.so.2 (0xb7446000)
        /lib/ld-linux.so.2 (0xb7711000)

The good news is that there is an SSL enabled version of telnet, called  telnet-ssl (netkit-telnet-ssl).  In the following examples, I am using the BackTrack 4 distribution.

# apt-get install telnet-ssl
# ldd /usr/bin/telnet
        linux-gate.so.1 =>  (0xffffe000)
        libncurses.so.5 => /lib/libncurses.so.5 (0xb76cb000)
        libssl.so.0.9.8 => /usr/lib/i686/cmov/libssl.so.0.9.8 (0xb7684000)
        libcrypto.so.0.9.8 => /usr/lib/i686/cmov/libcrypto.so.0.9.8 (0xb7537000)
        libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0xb7449000)
       [snip]

# ls -l `which telnet`
lrwxrwxrwx 1 root root 24 Dec  1 10:48 /usr/bin/telnet -> /etc/alternatives/telnet
# ls -l /etc/alternatives/telnet
lrwxrwxrwx 1 root root 19 Dec  1 10:48 /etc/alternatives/telnet -> /usr/bin/telnet-ssl

# telnet -z ssl ssl.somehost.com 443
Trying 10.10.3.93...
Connected to ssl.somehost.com.
Escape character is '^]'.
GET / HTTP/1.1
HOST: ssl.somehost.com

HTTP/1.1 200 OK
Content-Type: text/html
Last-Modified: Thu, 11 Nov 2010 15:08:59 GMT
Accept-Ranges: bytes
Server: Microsoft-IIS/7.5
Date: Wed, 01 Dec 2010 17:07:40 GMT
Content-Length: 519
[snip]

Metasploit

Another alternative to installing netkit-telnet-ssl is to use Metasploit itself.  Of course Metasploit might be an overkill if all you want to do is perform simple tests like the one above.  In the case of BackTrack 4 distribution, Metasploit comes installed by default. 

msf > connect -s ssl.somehost.com 443

[*] Connected to ssl.somehost.com:443
GET / HTTP/1.1
HOST: ssl.somehost.com

HTTP/1.1 200 OK
Content-Type: text/html
Last-Modified: Thu, 11 Nov 2010 15:08:59 GMT
Accept-Ranges: bytes
Server: Microsoft-IIS/7.5
Date: Wed, 01 Dec 2010 17:07:40 GMT
Content-Length: 519
[snip]

If you know of any standard tools on Linux and Windows or any 3^rd party tools for Windows, which can do the same, please leave a comment.

Cheers,

VVK

SSL/TLS Weak Cipher

While reviewing a Qualys report, I noticed the following "QID: 38140 SSL Server Supports Weak Encryption Vulnerability".  Of course one can verify Qualys findings one cipher at a time using openssl, but in order to verify all supported cipher-MAC combination, I needed to find an automated tool. Here are some of the useful ones I found:

1. Qualys SSL Labs - Good choice if you need to generate a presentable report for management.
2. CryptoNark - In addition to checking SSL Ciphers, it also does HTTP Track/Trace check and 'Unsafe' URL check.  You will need to install some custom Perl modules to get it working.
3. SSLscan - Comes bundled with BackTrack4.

It is a lot easier to quickly verify your remediation using these tools, as opposed to submitting another Qualys scan.

Update (6/21/11): Here is a new tool from Leviathan Security to help test SSL Re-negotiation vulnerability. (also see "(Really) Testing for SSL/TLS Re-negotiation")

Cheers,
VVK

Quick 'n' Dirty Bulk Reverse Lookup

Although you can do bulk forward look-ups using '-f' option in dig, for some reason this does not work for reverse look-ups. See: Dig HowTo

So, I whipped up a quick python script to get the job done. Script assumes you have a file with list of IP's, one per line.

input = open('ips.txt','r')
for i in input.readlines():
   try:
      result = socket.gethostbyaddr(i)
      print i.strip('\n'),result[0]
   except:
      continue

Please use the script at your own risk!

I got the following trick from my good friend Kevin to accomplish similar result using nmap:

nmap -sL -iL fileofips.txt | grep '('

Cheers,
VVK

Shifted Password Strategy = Simple Obfuscation

Recently Adam Pash posted an article on lifehacker titled “Shift Your Fingers One Key to the Right for Easy-to-Remember but Awesome Passwords”. The basic idea behind this trick is to generate what appear to be complex passwords by merely placing your fingers one key to the right and typing something easy to remember. For example, “Password” would become “{sddeptf”.

Due to a lack of a better term, I will call this approach “Shifted Password” in this post.

Initially I thought Shifted Password was a great idea, and I wondered if it is a better and simpler approach to the one proposed by Bruce Schneier’s in his Wired article titled “Secure Passwords Keep You Safer”. However after careful consideration, I have come to the conclusion that Shifted Password approach is neither practical nor secure.

Practicality
People are no longer accessing their password protected resources using only a laptop/desktop with a full size keyboard. The use of alternative input mechanisms and variations in keyboard layout (iPhone, Blackberry, Dvorak etc.) renders Shifted Password strategy ineffective.

Security
Although passwords generated using Shifted Password strategy might appear to be strong (more complex), the fact is Shifted Password is merely an obfuscation of a simple password (easy to remember). In other words, shifted password is not a good substitute for a complex password.

For example, if someone wants to use "myDogSpot” as the password, the Shifted Password version would look like “,uFphD[py”. Looks secure! But is it? The fact is it is still vulnerable to a dictionary brute force attack. These attacks might not be common yet, but it is a matter of time till the attackers smarten up and modify their attack strategy to include this obfuscated variation.

Over at Command Like Kung Fu blog, they already have a post titled "Shifty Passwords” which shows how easy it is to compensate for this obfuscation using unix tr command and generate a new shifted version dictionary based on an existing dictionary.

$ cat dict.txt | tr "$r1$R1$r2$R2$r3$R3$r4$R4" "$r1s$R1s$r2s$R2s$r3s$R3s$r4s$R4s" >shift-dict.txt

Conclusion
In the lifehacker article, Adam Pash concludes:

"Something longer but still really lame, like, say, "topsecretpassword", becomes "yp[drvtry[sddeptf". These may not be perfect compared to secure password generators, but they're likely orders of magnitude better than a lot of people's go-to passwords."

I would humbly disagree with Adam, because I think that the appearance of complexity could fool a user into a false sense of security. I think claiming that Shifted Password approach is "magnitude better" is a bit of a false advertisement.

If you are willing to accept the practical limitation of Shift Password strategy, it could prove to be useful, granted that you use a complex password to start with (catch 22!).

In my book, I am going to score this as Bruce Schneier 1, Adam Pash 0. :-)

Cheers,
VVK

BackInTime on CentOS 5.x

Back In Time is a simple backup tool geared mostly toward Linux desktop. Only Debian/Ubuntu binary packages are available from the official website.

I like Back In Time because it uses standard Linux tools like rsync,diff and cp to create backups and heavily utilizes hard-links to save space on the backup media.

I wanted to install it on a CentOS 5.x host and decided to create an RPM so others can use it on RPM based distros.

Spec File: backintime-cli.spec
Source RPM: backintime-cli-0.9.26-1.src.rpm
x86 RPM: backintime-cli-0.9.26-1.rhel5.i386.rpm

Configuration
Configuration file is located in /etc/backintime/config. I haven't yet found any useful documentation. The included config file was generated by the KDE4 GUI client. I removed many of the GUI specific configuration lines. If you come across good documentation, please leave a comment.

If you run /usr/bin/backintime as root, it uses /etc/backintime/config for configuration.
If you wish to run backintime as a regular user, copy the /etc/backintime/config file to ~/.config/backintime/config.

Here is what I have managed to figure out from experimenting using the GUI client:

config.version=2
snapshots.automatic_backup_mode=20
snapshots.cron.nice=true

# Manually run snapshots are not removed automatically
snapshots.dont_remove_named_snapshots=true
snapshots.exclude_patterns=*.backup*:*~

# Useful if you have mixed snapshot frequencies
snapshots.expert.per_directory_schedule=true

#0-manual,10-hourly,20-daily,30-weekly,40-monthly
# [file/folder]|[snapshot frequency]
snapshots.include_folders=/etc|30:/home:|20:/root|30:/var/named|40
snapshots.min_free_space.enabled=true

# 10=Mb, 20=Gb
snapshots.min_free_space.unit=20

# Maintain minimum of 1G free space on destination
snapshots.min_free_space.value=1
snapshots.notify.enabled=true

# Backup destination. Create 'backintime' folder manually.
snapshots.path=/backup
snapshots.remove_old_snapshots.enabled=true

# 20=days,30=weeks,80=years
snapshots.remove_old_snapshots.unit=30

# Remove backups older than 27 weeks
snapshots.remove_old_snapshots.value=27

# keep all snapshots from today & yesterday
# keep one snapshot for the last week and one for two weeks ago
# keep one snapshot per month for all previous months of this year
# keep one snapshot per year for all previous years
snapshots.smart_remove=true

Sample run:

[root@lamp32 ~]# backintime -b /etc
Back In Time
Version: 0.9.26

Back In Time comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions; type `backintime --license' for details.

INFO: Lock
INFO: Include folders: ['/etc']
INFO: Ignore folders: []
INFO: Last snapshots: {}
INFO: Compare with old snapshot: 20100320-181730
INFO: Command "rsync -aEAX -i --dry-run --chmod=Fa-w,D+w --whole-file --delete --exclude="/backup" --exclude="/root/.
local/share/backintime" --include="/etc/" --exclude="*.backup*" --exclude="*~" --include="/etc/**" --exclude="*" / "/bac
kup/backintime/20100320-181730/backup/"" returns 0
INFO: Create hard-links
INFO: Command "cp -al "/backup/backintime/20100320-181730/backup/"* "/backup/backintime/new_snapshot/backup/"" returns 0
INFO: Call rsync to take the snapshot
INFO: Command "rsync -aEAX -v --delete-excluded --chmod=Fa-w,D+w --whole-file --delete --exclude="/backup" --exclude="/root/.local/share/backintime" --include="/etc/" --exclude="*.backup*" --exclude="*~" --include="/etc/**" --exclude="*" / "/backup/backintime/new_snapshot/backup/"" returns 0
INFO: Save permissions
INFO: Remove backups older than: 20090907-000000
INFO: [smart remove] keep all >= 20100319-000000
INFO: [smart remove] keep first >= 20100308-000000 and <>= 20100301-000000 and <>= 20100101-000000 and <>= 20100201-000000 and <>

Hope this helps someone looking to run backintime on RHEL/CentOS.

Cheers,
VVK

Antivirus False Positive Validation

ClamAV running on a clients server flagged a packed javascript file as a virus. A co-worker recommended Virustotal website for testing and fortunately it appears to be a false positive based on the fact that only 1 (ClamAV) out of 41 anti-virus solutions flagged it as a virus.

Update: Javascript Unpacker tool.

Update 4/8/10: Jotti's Malware Scan
Also check out the following post from Kerbs:
Virus Scanners for Virus Authors - Part 1
Virus Scanners for Virus Authors - Part 2

Cheers,
VVK

MySQL Backups to AWS Cloud

A client asked me to write a script to perform nightly MySQL database backups to the AWS cloud. They also viewed this as an opportunity to test the Amazon Web Services (AWS) waters.

They had the following requirements:

1. Full backup every night. No need to worry about differentials or incrementals.
2. Backups must be encrypted prior to transmission.
3. Transmission must take place over secure channel.
4. Following a backup run, an email notification must be sent to the DBA's.
5. Documentation.

Rather than re-invent the wheel, and write the tool from scratch, I decided to do some research. I came across two Open Source resources, which combined together with some modifications, addressed my clients needs.

Resources:

1. MySQL Backup script with encryption
2. s3cp - Amazon S3 command line cp program
   

Modifications:

1. Instead of 3DES, I used AES192 CBC mode, mostly due to performance reasons. Also, due to Cipher Block Chaining mode, any file corruption during file transfer would be detected during decryption.
2. Integrated s3cp for uploading the resulting encrypted dump file to AWS S3.
3. Added lines to calculate backup size and md5 checksum to be included in the emails sent to DBAs.
4. Added email notification feature.

You can download the script and support files HERE. A redacted version of documentation will follow.

Update: Redacted documentation "AWS_MySQL_backup.pdf"

Thanks,
VVK

SMTP Service & Spam

While trying to figure out DNS settings to ensure that the mail sent via our SMTP server does not end up in spam folder, I came across the following resources:

1. Fixing common DNS problems - Must read!
2. Sender Authentication - What To Do by Meng Weng Wong
   
3. 6 Simple Steps To Improving e-mail Deliverability
   
4. RFC2505 - Anti-Spam Recommendations for SMTP MTAs
5. Application Note: How to secure your mail system against third-party relay
6. Sender Policy Framework - Check out the SPF wizard
   

Cheers,

VVK

Updates:
- Added "6 Simple Steps To Improving e-mail Deliverability" link (Jan 25th)
- Added "Sender Authentication - What To Do by Meng Weng Wong" and "Sender Policy Framework" link (Jan 26th)

Minimal Postfix (SMTP only)

While configuring Aide on a standalone system, I needed to configure SMTP in order to receive the cron job output. In absence of a mail gateway server willing to relay, I was left with the only option of running a local SMTP daemon. I installed Postfix and noticed that by default it runs on loopback interface and starts approximately 83 processes.

[root@localhost postfix]# netstat -ap | grep master | wc -l

83

I didn't really need all the additional Postfix features, so I set out to configure the bare minimum setup.

After spending some time going through the /etc/postfix/master.cf file, and some trial and error, I managed to narrowed the configuration down to the following:

smtp inet n - n - - smtpd

pickup fifo n - n 60 1 pickup

cleanup unix n - n - 0 cleanup

qmgr fifo n - n 300 1 qmgr

tlsmgr unix - - n 1000? 1 tlsmgr

rewrite unix - - n - - trivial-rewrite

smtp unix - - n - - smtp

Now, Postfix starts up only 20 processes.

[root@localhost postfix]# netstat -ap | grep master | wc -l

20

Note: Mail sent using such a setup is most likely to end-up in your spam folder.

Cheers,

VVK

Unintrusive RPM Distro Audit

As a consultant, I am often faced with an unfamiliar Linux system (usually RHEL). I always find it useful to understand which files that shipped with rpm packages have been modified, since it is usually a good indicator of what customizations have been performed on the system. To determine the modified files, I simply run:

% rpm -qa | xargs rpm --verify --nomtime | less

# Sample output:

missing /usr/local/src
.M...... /bin/ping6
.M...... /usr/bin/chage
.M...... /usr/bin/gpasswd
....L... c /etc/pam.d/system-auth
.M...... /usr/bin/chfn
.M...... /usr/bin/chsh
S.5..... c /etc/rc.d/rc.local
S.5..... c /etc/sysctl.conf
S.5..... c /etc/ssh/sshd_config
S.5..... c /etc/updatedb.conf

The following is taken from the rpm man pages (Verify Options section):



c %config configuration file.
d %doc documentation file.
g %ghost file (i.e. the file contents are not
included in the package payload).
l %license license file.
r %readme readme file.

S file Size differs
M Mode differs (includes permissions and file type)
5 MD5 sum differs
D Device major/minor number mismatch
L readLink(2) path mismatch
U User ownership differs
G Group ownership differs
T mTime differs

Using this trick, I can quickly determine what configuration files have been modified as well as any metadata modifications (ownership, link etc.).

Cheers,
VVK

Save VM State During Logout

I run multiple VM's using VirtualBox on my laptop.  Few time I forgot to shutdown the VM's prior to logging off, which caused me to loose my work.  So, I decided to write a little script to save the state prior to logoff.

Add the following to your ~/.bash_logout


for vm in `/usr/bin/VBoxManage list runningvms | grep -E "^\"" | awk -F "\"" '{print $2}'`;
do
   /usr/bin/logger -p local0.info -t VirtualBox "Saving state: $vm"
   /usr/bin/VBoxManage controlvm $vm savestate | grep % | logger -p local0.info -t VirtualBox
done


Sample /var/log/messages output:

Oct 7 00:43:46 moonshine VirtualBox: Saving state: lamp32
Oct 7 00:43:48 moonshine VirtualBox: 0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%


Cheers,
VVK

Linux VM Kernel Tweaks

Based on "Oracle 10g Server on Red Hat Enterprise Linux 5 - Deployment Recommendations", I updated my VirtualBox Linux VM's to use the following kernel parameters:

64bit RHEL/CentOS VM: divider=10 notsc iommu=soft elevator=noop
32bit RHEL/CentOS VM: divider=10 clocksource=acpi_pm iommu=soft elevator=noop

Consult /usr/share/doc/kernel-doc-2.6.18/Documentation (kernel-doc-2.6.18-164.el5 rpm) for more info on these parameters.  The above mentioned Oracle document does a good job of explaining the parameters as well.

Although, I did not do any scientific measurements, just from the CPU usage live graph and pidstat (sysstat), I can confirm that my CPU usage dropped drastically.

Pre-tweak:

$ pidstat -u -p 22414 5 10  
Linux 2.6.30.8-64.fc11.i586 (moonshine) 10/06/2009

01:49:27 PM PID %user %system %CPU CPU Command
01:49:32 PM 22414 39.20 28.00 67.20 1 VBoxHeadless
01:49:37 PM 22414 40.80 27.60 68.40 1 VBoxHeadless
01:49:42 PM 22414 37.80 28.40 66.20 1 VBoxHeadless
01:49:47 PM 22414 38.40 27.80 66.20 1 VBoxHeadless
01:49:52 PM 22414 38.60 28.20 66.80 1 VBoxHeadless
01:49:57 PM 22414 36.40 28.20 64.60 1 VBoxHeadless
01:50:02 PM 22414 38.80 26.20 65.00 1 VBoxHeadless
01:50:07 PM 22414 38.40 28.80 67.20 1 VBoxHeadless
01:50:12 PM 22414 38.40 29.00 67.40 1 VBoxHeadless
01:50:17 PM 22414 38.00 27.80 65.80 1 VBoxHeadless
Average: 22414 38.48 28.00 66.48 - VBoxHeadless


Post-tweak:

$ pidstat -u -p 22414 5 10
Linux 2.6.30.8-64.fc11.i586 (moonshine) 10/06/2009

01:53:55 PM PID %user %system %CPU CPU Command
01:54:00 PM 22414 3.20 3.60 6.80 1 VBoxHeadless
01:54:05 PM 22414 3.20 3.60 6.80 1 VBoxHeadless
01:54:10 PM 22414 2.80 3.40 6.20 1 VBoxHeadless
01:54:15 PM 22414 2.80 2.80 5.60 1 VBoxHeadless
01:54:20 PM 22414 3.00 3.20 6.20 1 VBoxHeadless
01:54:25 PM 22414 3.60 3.80 7.40 1 VBoxHeadless
01:54:30 PM 22414 4.00 4.40 8.40 1 VBoxHeadless
01:54:35 PM 22414 3.20 3.00 6.20 1 VBoxHeadless
01:54:40 PM 22414 5.00 5.80 10.80 1 VBoxHeadless
01:54:45 PM 22414 6.40 4.00 10.40 1 VBoxHeadless
Average: 22414 3.72 3.76 7.48 - VBoxHeadless

Cheers,
VVK

Tomcat Startup Script

Here is my version of Tomcat startup script, which is partially based on neo220 and akadia scripts.  Please make sure TOMCAT_USER is the owner of CATALINA_HOME and CATALINA_PID folders.

/etc/sysconfig/tomcat
TOMCAT_USER=tomcat
JAVA_HOME=/usr/local/sun-jdk
JRE_HOME=/usr/local/sun-jre
#CATALINA_OPTS=
#JAVA_OPTS=
CATALINA_PID=/var/run/tomcat/tomcat.pid
CATALINA_TMPDIR=/var/tmp
#LOGGING_CONFIG=
#LOGGING_MANAGER=
TOMCAT_HOME=/usr/local/tomcat/bin
START_TOMCAT=$TOMCAT_HOME/startup.sh
STOP_TOMCAT=$TOMCAT_HOME/shutdown.sh


export TOMCAT_USER JAVA_HOME JRE_HOME CATALINA_OPTS JAVA_OPTS CATALINA_PID LOGGING_CONFIG LOGGING_MANAGER


/etc/init.d/tomcat
#!/bin/bash
# chkconfig: 345 20 80
# description: Tomcat Server basic start/shutdown script
# processname: tomcat

# pull in sysconfig settings
[ -f /etc/sysconfig/tomcat ] && . /etc/sysconfig/tomcat

start() {
       echo -n "Starting tomcat: "
       if [ -f $CATALINA_PID ]; then
              rm -f $CATALINA_PID  
       fi
       cd $TOMCAT_HOME
       su $TOMCAT_USER -c ${START_TOMCAT}
       echo "done."
}
stop() {
       echo -n "Shutting down tomcat: "
       cd $TOMCAT_HOME
       ${STOP_TOMCAT}
       rm -f $CATALINA_PID
       echo "done."
}
status() {
       if [ -f $CATALINA_PID ]; then
              x=$(ps -p `cat $CATALINA_PID` | wc -l)
              if [ $x == 2 ]; then
                     echo "Tomcat (pid `cat $CATALINA_PID`) is running..."
              else
                     echo "PID file exists, but tomcat appears to be not running..."
              fi
       else
              echo "Tomcat is not running..."
       fi
}

case "$1" in
start)
       start
       ;;
stop)
       stop
       status
       ;;
restart)
       stop
       sleep 10
       start
;;
status)
       status
       ;;
*)
       echo "Usage: $0 {start|stop|restart}"
esac
exit 0


Thanks,
VVK