Re: tomcat security

Yes. There is the catalina.policy file in the conf/ directory. See http://jakarta.apache.org/tomcat/tomcat-5.0-doc/security-manager-howto.html for details. Ben Ricker On 8/9/05, Cengiz Yazgan [EMAIL PROTECTED] wrote: Hi everybody I have a problem about tomcat security One of my friend

RE: tomcat security

List Subject: Re: tomcat security Yes. There is the catalina.policy file in the conf/ directory. See http://jakarta.apache.org/tomcat/tomcat-5.0-doc/security-manager-howto.html for details. Ben Ricker On 8/9/05, Cengiz Yazgan [EMAIL PROTECTED] wrote: Hi everybody I have a problem about tomcat

Re: Tomcat security realms question

The problem you describe is true of any session tracking system running over http. The solution is to use https. However, here's a question to fire back at your security team: If you are worried about an attacker physically looking at a session ID on a user's screen, what about if they decide

RE: Tomcat security realms question

Thanks a lot for your reply. We'll see if we can persuade our security guys to drop this issue. Kind regards, Alex. -Original Message- From: Mark Thomas [mailto:[EMAIL PROTECTED] Sent: Monday, 18 July 2005 2:50 AM To: Tomcat Users List Subject: Re: Tomcat security realms question

RE: Tomcat security stopping log4j write to a file

Hi, Two options come to mind. Either You're running with a SecurityManager and your java.policy file doesn't specify a write permission into WEB-INF/logs. Or you've misconfigured log4j. If this is the case, post your log4j configuration file and we can help you although that's a bit off-topic

Re: Tomcat security stopping log4j write to a file

Lawrence J Winkler wrote: I want log4j to write its output to the webapps/[application dir]/WEB-INF/logs directory. The log4j properties file is located in the WEB-INF/classes directory, as specified. Monitoring trace of log4j's process, shows log4j is unable to find (create) the requested

Re: Tomcat security and virtual hosts

On 21-05-2004 11:33, wsedio wrote: Hi all, I am running Tomcat 5.0.24 on Red Hat Linux Enterprise 3 with Apache web server 2 and mod_jk 1.2. I have a few Apache/Tomcat virtual hosts: each host has its own document root and webapps. I would like to make sure that each host is not allowed to

RE: Tomcat security

Hi, The declarative security options offered by the Servlet Specification, those you refer to as the integrated security options, have no understanding of the client side, i.e. the browser. There is no concept of frame or browser, so you can't do what you're asking for with these declarative

Re: Tomcat Security Constraints

On Thu, Apr 08, 2004 at 06:36:16PM +0200, Malcolm Warren wrote: : Surely the authorization should be requested in all places and at all : times, whereever the request is coming from, even if from an include in an : unprotected page? Clearly not, if it's going through. ;) My understanding of

RE: Tomcat security

Howdy, We will install Tomcat 4.1.24 on a server which is behind our corporate Why not 4.1.27? Now, my question is that, what is the common practice to guard against people accessing the catalina_home directory? I plan to install Tomcat on the D drive instead of the C drive where the OS

Re: Tomcat security?

July 6th, turn your server off. July 7th, turn it back on. Problem solved ;) -Tim Eugene Lee wrote: Anyone want to discuss hardening Tomcat servers? Hacking Contest Threatens Web Sites By George V. Hulme, InformationWeek Updated Wednesday, July 2, 2003, 3:00 PM EDT A

Re: Tomcat security?

When was the last time Tomcat had a published exploit? On a related note, these kind of contests are fairly common, and usually don't produce any kind of real activity. --Nathan - Original Message - From: Eugene Lee [EMAIL PROTECTED] To: Tomcat Users List [EMAIL PROTECTED] Sent:

Re: Tomcat security?

http://www.amazon.com/exec/obidos/tg/detail/-/1861008309/ If you're just worrying about it now, its probably too late. John On Thu, 3 Jul 2003 10:51:52 -0500, Eugene Lee [EMAIL PROTECTED] wrote: Anyone want to discuss hardening Tomcat servers? Hacking Contest Threatens Web Sites By

Re: Tomcat security?

AFAIK, November 2002. John On Thu, 3 Jul 2003 11:14:26 -0500, Nathan McMinn [EMAIL PROTECTED] wrote: When was the last time Tomcat had a published exploit? On a related note, these kind of contests are fairly common, and usually don't produce any kind of real activity. --Nathan -

Re: Tomcat security?

Any idea what it was and/or what versions it affected? - Original Message - From: John Turner [EMAIL PROTECTED] To: Tomcat Users List [EMAIL PROTECTED] Sent: Thursday, July 03, 2003 11:13 AM Subject: Re: Tomcat security? AFAIK, November 2002. John On Thu, 3 Jul 2003 11:14:26

Re: Tomcat security?

] To: Tomcat Users List [EMAIL PROTECTED] Sent: Thursday, July 03, 2003 11:13 AM Subject: Re: Tomcat security? AFAIK, November 2002. John On Thu, 3 Jul 2003 11:14:26 -0500, Nathan McMinn [EMAIL PROTECTED] wrote: When was the last time Tomcat had a published exploit? On a related note

Re: Tomcat security?

I can't believe that passwords for SSL are stored in the clear. That places all responsibility of security to the OS, which may not be a good idea. What happened to defense-in-depth ?? Nathan McMinn wrote: When was the last time Tomcat had a published exploit? On a related note, these kind

Re: Tomcat security?

read access and only to the required user and roles tables. - Original Message - From: Mark W. Webb [EMAIL PROTECTED] To: Tomcat Users List [EMAIL PROTECTED] Sent: Thursday, July 03, 2003 1:55 PM Subject: Re: Tomcat security? I can't believe that passwords for SSL are stored in the clear

Re: Tomcat security?

the DB for the realm is only granted read access and only to the required user and roles tables. - Original Message - From: Mark W. Webb [EMAIL PROTECTED] To: Tomcat Users List [EMAIL PROTECTED] Sent: Thursday, July 03, 2003 1:55 PM Subject: Re: Tomcat security? I can't believe

Re: Tomcat security?

There is a plugin for TC 3.3.x to force prompting for the keystore password. Largely due to lack of user interest, nobody has really tried porting it to TC 4.x-5.x. Mark W. Webb [EMAIL PROTECTED] wrote in message news:[EMAIL PROTECTED] I can't believe that passwords for SSL are stored in the

RE: tomcat security

Did you start tomcat with start security? If not, some else messed up. -Original Message- From: Maxime Colas des Francs [mailto:[EMAIL PROTECTED] Sent: June 10, 2003 3:23 PM To: [EMAIL PROTECTED] Subject: tomcat security Hi, Is there a typical security configuration for a web

RE: tomcat security

of course yes i start tomat with -security and -Djava.security.debug=access,failure for trace else no security exception At 15:16 2003-06-10 -0400, you wrote: Did you start tomcat with start security? If not, some else messed up. -Original Message- From: Maxime Colas des Francs

Re: Tomcat security concerns during start-up

I do not see this as a problem. You can lock the Tomcat account (do have to give it a shell, though) and no one should be able to get into the account. I use 'sudo' to allow others the ability to start and stop Tomcat which 'su's to the Tomcat user before executing. I myself use the Tomcat group,

Re: Tomcat security concerns during start-up

I'm not sure if I making a correct assumption, but isn't it possible that someone can exploit the running tomcat process and gain access as tomcat into the system (if so, having write permission on the conf dir is dangerous) --- Ben Ricker [EMAIL PROTECTED] wrote: I do not see this as a

RE: Tomcat security configuration guide

Wrox Press. ISBN: 1861008309 John -Original Message- From: Manavendra Gupta [mailto:[EMAIL PROTECTED]] Sent: Thursday, February 13, 2003 2:44 PM To: Tomcat Users List Subject: Tomcat security configuration guide Hi, I have begun to work on a tomcat security configuration guide as a

Re: tomcat security issue

SecurityManager permission problems are much easier to debug if you start tomcat with the -Djava.security.debug=access,failure property defined, then check your logs for the string denied. Then review the stack trace and the ProtectionDomain which failed. Regards, Glenn [EMAIL PROTECTED]

Re: tomcat security issue

I wish I could see some log files. Only file that seems to be active is catalina.out any assistance in this matter would be appreciated here is the entry for the service Service name=Tomcat-Apache13 Connector className=org.apache.ajp.tomcat4.Ajp13Connector port=8009

Re: tomcat security issue

Is alvolo.servlet.DispatcherServlet.initialiseSession try to get access to org.apache.catalina.core.ApplicationDispatcher ? That's the normal behaviour if your answer is yes. Tomcat internal classes are protected against package access/insertion. If you really want to use that class, add to

Re: tomcat security issue

thanks for the reply my code that seems to cause the problem is as follows: HttpSession session = request.getSession(); session.setAttribute( customerProfile, new Profile() ); session.setAttribute( loggedIn, new Boolean( false ) ); session.setAttribute(

Re: tomcat security issue

If you run the same code without the SecurityManager, do you get the same exception? Is the factoryLoaderServlet defined in your web.xml? -- Jeanfrancois [EMAIL PROTECTED] wrote: thanks for the reply my code that seems to cause the problem is as follows: HttpSession session =

Re: tomcat security issue

yes the factoryLoaderServlet is defined too complex and issue currently to restart without SecurityManager. May be able to do overnight. Other dependent apps need to be up during the day Warren On Wednesday, October 23, 2002, at 04:19 PM, Jean-Francois Arcand wrote: If you run the same

Re: Tomcat Security Problem Help (using mod_jk)

On Wed, 25 Sep 2002, Ramilio D wrote: Hi Everyone, I read in the buqraq posting that I could fix the source code exposure vulnerablilty in tomcat by modifying the JkMount directive. I took a quick look at some documentation but I couldn't figure out how to allow apache serve servlets yet

RE: Tomcat Security Problem Help (using mod_jk)

Do not mount /servlet/* but only the servlets that you application is really using. Regards, Rossen Raykov -Original Message- From: Ramilio D [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 25, 2002 12:30 AM To: [EMAIL PROTECTED] Subject: Tomcat Security Problem Help (using

Re: tomcat security

Take a look on Running Tomcat with SecurityManager. I'm sure you can find a lot of docs on the net. On Thu, 19 Sep 2002 15:23:09 -0400, Steven Garrett [EMAIL PROTECTED] escreveu : De: Steven Garrett [EMAIL PROTECTED] Data: Thu, 19 Sep 2002 15:23:09 -0400 Para: 'Tomcat Users List' [EMAIL

Re: tomcat security

The Tomcat site contains the following: http://jakarta.apache.org/tomcat/tomcat-4.0-doc/security-manager-howto.html and http://jakarta.apache.org/tomcat/tomcat-4.0-doc/ssl-howto.html The security manager is probably the first place to start. -- Jeanfrancois Steven Garrett wrote: Hi, I'm

RE: Tomcat security question

You would probably be best off implementing it in a servlet. The servlet can authenticate the user, determine the specific file, and then send the file (not redirect) to the client. Since you are sending the file the files can reside anywhere on the system or even on another system.

RE: tomcat security, JDBCRealm, SimpleRealm readable passwords

Hi, I've set up tomcat 3.3 and almost everything works fine. I've set up a mySQL database 'authority' to authenticate against in a simple test webapplication. And now I have the following question and maybe someone can help me. I don't like having passwords on my filesystem readable to

RE: Tomcat Security Architecture and RSA ACE authentication

Hi, My client is going to adopt RSA ACE security infrastructure which to my understanding will require users to append a hardware generated number to their passwords when they authenticate. So we will have system where password changes every 15 seconds and it can not be cached in tomcat and

Re: Tomcat Security Architecture and RSA ACE authentication

On Mon, 26 Mar 2001, Roytman, Alex wrote: Hello, I wrote JNDI(LDAP) realm for tomcat 3.x based similar to JDBCRealm provided with tomcat Would you be interested in contributing this code to the Tomcat 3 (and/or 4) code bases? My client is going to adopt RSA ACE security infrastructure

RE: Tomcat Security Architecture and RSA ACE authentication

Title: RE: Tomcat Security Architecture and RSA ACE authentication -Original Message- From: Roytman, Alex Sent: Monday, March 26, 2001 1:38 PM To: '[EMAIL PROTECTED]' Subject: RE: Tomcat Security Architecture and RSA ACE authentication Craig, Thank you for such a prompt reply

Re: Tomcat Security example and Admin Tool

Yep, for Context admin add a user with role admin to tomcat-users.xml Boon Yeo wrote: Has anyone successfully got the Tomcat JSP Security example running? What about Tomcat Context Admin Tools? -Boon

Re: Tomcat Security example and Admin Tool

es. Weird. -Boon - Original Message - From: "Vladimir Grishchenko" [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, March 15, 2001 3:40 PM Subject: Re: Tomcat Security example and Admin Tool Yep, for Context admin add a user with role admin to tomcat-users.xml Boon

Re: Tomcat security.

Do you mean encrypt the information the user enters in the jsp, ie encrypting the info sent from client desktop to web server? In which case, SSL is the best bet, although I don't think this is what you mean :-) We have a system wehereby a servlet has to send information to a (potentially) remote

Re: Tomcat security.

Date: Fri, 09 Mar 2001 16:21:43 To: [EMAIL PROTECTED] From: "Thomas O' Connor" [EMAIL PROTECTED] Subject: Tomcat security. Message-ID: [EMAIL PROTECTED] Does anyone know a simple way to encrypt information sent from a jsp page hosted on tomcat and then decrypt the info when it reaches

Re: Tomcat security.

Tom, I'm not a PC kinda guy, and don't deal with ms access. But, I asked a couple of the PC support folk here, and no one is aware of any native crypto support in ms access. My guess is that you'll need to write a java component on the host running ms access that can talk to the database,

Re: Tomcat Security

Jim Urban wrote: I am running Tomcat with Apache on NT. I have a servlet context which contains three servlets and their supporting classes. All the .class files have been "jared" and the .jar file placed in the web-inf/lib directory. I have set up my web.xml file to find the servlets an