from:"Richard S. Huntrods"


Greetings!

Is it possible to view an SSL document without using the https prefix?

Before I enabled SSL on my servlets, I was using port 8080.  Now I have
SSL working, and have disabled the normal non-SSL port 8080.  Instead,
I am using SSL on port 8080.  This makes my application ONLY run with
SSL.

I can change any references internal to my system (index.html, etc) to
use https, but some clients have bookmarked the servlet page, rather
than the access page.  Is there a way to redirect
http://xx.xx.xx.xx:8080/index.html; to *actually* call up the page
https://xx.xx.xx.xx:8080/index.html; ?

Thanks very much in advance,

-Richard




--
To unsubscribe:   mailto:[EMAIL PROTECTED]
For additional commands: mailto:[EMAIL PROTECTED]
Troubles with the list: mailto:[EMAIL PROTECTED]

Tompcat - Manager Functions without the Manager?


Greetings!

For security purposes, my tomcat server is behind a firewall, with the
firewall forwarding port 8080 requests to the server (as port 8080).
All works very well. FTP and Telnet are blocked by the firewall as
well.  Only port 80 (another machine running Apache to serve a web site)
and port 8080 are open on this firewall.

Also for security, I have removed the original webapps directory and
replaced it with my own webapps directory with just my servlets and
such in it.  Again, all works very, very well.

NOW - I would like to track who is currently using the system.  Apache
is not running - only Tomcat.  Rather than try to track users internally
with my servlets, I would like to be able to use the Tomcat manager
functions to do this. Is there a way to use manager functions without
the original webapps/manager directory - i.e. ONLY from behind the
firewall, perhaps even only when logged on to the server as root?  My
understanding is that if I put the manager directory back, then it is
open to the world (password protection is rarely enough, I've found).

Thanks in advance,

-Richard



--
To unsubscribe:   mailto:[EMAIL PROTECTED]
For additional commands: mailto:[EMAIL PROTECTED]
Troubles with the list: mailto:[EMAIL PROTECTED]

RE: Can you view SSL without the https prefix?


 I can change any references internal to my system (index.html, etc)
to
 use https, but some clients have bookmarked the servlet page,
rather
 than the access page.  Is there a way to redirect
 http://xx.xx.xx.xx:8080/index.html; to *actually* call up the page
 https://xx.xx.xx.xx:8080/index.html; ?

Can't you make whatever handles the http requests on 8080 return a
redirect
to the same page but with an https protocol request?

That's what I'm doing at present, but it requires support for both plain
(8080) pages and SSL (port 8443) pages.  I want to remove the normal
factory and only allow the SSL factory (in servlet.xml) - but then all
requests, even the initial one, must have https.  I'm looking for the
best of both worlds.  I'm also unsure of what would happen if BOTH
non-secure and secure pages come from port 8080 (in servlets.xml).

-Richard




--
To unsubscribe:   mailto:[EMAIL PROTECTED]
For additional commands: mailto:[EMAIL PROTECTED]
Troubles with the list: mailto:[EMAIL PROTECTED]

Re: Can you view SSL without the https prefix?


You can't have http and https listen on the same port since https has
an
entire SSL handshake that must take place before the GET/POST transfer
takes
place.  But you could have the 8080 redirect to something like 8081
with
HTTPs running on that instead.  Of course, the correct way is to use
port
80 for http, and redirect to 443 for https, since all other ports will
really have problems for just about anybody with a firewall correctly

configured.

David

Thanks for the excellent advice.  Question: if you type
https://xx.xx.xx.xx/; who is it that knows this goes to port 443?  I
have port 80 forwarded by my firewall to another machine running only
Apache.  Tomcat is on another machine, and I've been using port 8080
forwarded to that machine.

If I type in https://xx.xx.xx.xx/;, who knows that that should go to
port 443?  Is it whatever server is listening to port 80 (i.e. I then
must turn on redirection in Apache), or is this a net standard?

Thanks,

-Richard




--
To unsubscribe:   mailto:[EMAIL PROTECTED]
For additional commands: mailto:[EMAIL PROTECTED]
Troubles with the list: mailto:[EMAIL PROTECTED]

HTTP and HTTPS on two servers...


Greetings!

Well, the more you learn, the more you know how little you know! G

Current status:  I have two servers, one with Apache only and one with
Tomcat only.  This is for historic reasons of server load, but serves me
very well.

The Apache server listens only to port 80.  All works well.  For
example, http://xx.xx.xx.xx/; calls up the appropriate index.html page.

The Tomcat server now only listens to port 443 - and responds with SSL
enabled servlets.  This also works well.  For example:
https://yy.yy.yy.yy/; calls up a secure index.html file, which starts
the servlets rolling.

NOW, heres the problem. A router directs port 80 to the Apache server
and port 443 to the Tomcat server.  There is a domain name pointing to
the address of the router.  If you type http://domain.com/;, the Apache
server properly serves the web page.  HOWEVER - if you type
https://domain.com/;, you get the infamous page cannot be displayed
message.

How does one direct https inquiries to port 443?  I thought this would
work.  Who or what interprets https as a request on port 443?  Must I
configure the port 80 Apache machine to hear requests on port 443 and
then relay them to the Tomcat box - and if so, how?  (which Apache
config file)

Thanks very much in advance,

-Richard



--
To unsubscribe:   mailto:[EMAIL PROTECTED]
For additional commands: mailto:[EMAIL PROTECTED]
Troubles with the list: mailto:[EMAIL PROTECTED]

Re: HTTP and HTTPS on two servers...


Greetings! - Me again!

Problem solved.  I *was* correct - https has been standardized as port 443 -
so Netscape, Opera, IE - all must support it.

My particular problem was the defaultrouter file in Solaris.  My firewall
that forwarded port 443 to the Tomcat server was on one local address, but
the Tomcat machine was using another as the defaultrouter.   I edited
defaultrouter to point to the router that was doing the forwarding,
rebooted, and everything works!

Cheers,

-Richard

Richard S. Huntrods wrote:

 Greetings!

 Well, the more you learn, the more you know how little you know! G

 Current status:  I have two servers, one with Apache only and one with
 Tomcat only.  This is for historic reasons of server load, but serves me
 very well.

 The Apache server listens only to port 80.  All works well.  For
 example, http://xx.xx.xx.xx/; calls up the appropriate index.html page.

 The Tomcat server now only listens to port 443 - and responds with SSL
 enabled servlets.  This also works well.  For example:
 https://yy.yy.yy.yy/; calls up a secure index.html file, which starts
 the servlets rolling.

 NOW, heres the problem. A router directs port 80 to the Apache server
 and port 443 to the Tomcat server.  There is a domain name pointing to
 the address of the router.  If you type http://domain.com/;, the Apache
 server properly serves the web page.  HOWEVER - if you type
 https://domain.com/;, you get the infamous page cannot be displayed
 message.

 How does one direct https inquiries to port 443?  I thought this would
 work.  Who or what interprets https as a request on port 443?  Must I
 configure the port 80 Apache machine to hear requests on port 443 and
 then relay them to the Tomcat box - and if so, how?  (which Apache
 config file)

 Thanks very much in advance,

 -Richard



--
To unsubscribe:   mailto:[EMAIL PROTECTED]
For additional commands: mailto:[EMAIL PROTECTED]
Troubles with the list: mailto:[EMAIL PROTECTED]

SSL and W2K vs. Solaris - SOLVED

2001-12-19 Thread Richard S. Huntrods


Greetings!

I have solved the problem I was having with getting SSL to work on
Solaris.  As you may recall, I had it all working on W2K with Tomcat
4.0.1, but could not get it to run under Solaris 8 (SPARC).

The problem was simple, as was the solution.  Java 1.2 (default Java on
Solaris 8) is missing the security components required to support SSL.
I upgraded my Solaris box to 1.3.1, copied the jsse jar files to
JDK/jre/lib/ext (as recommended in the SSL installation documents),
rebooted and all worked the first time - with my certificate created on
the W2K box.

One final question - If I *always* want SSL to be on for this server
(i.e. no unsecured pages or servlets), do I comment out the normal
server stuff in server.xml and change the SSL port to 8080 (which I'm
using for everything at the moment), or are there additional steps?
Tomcat is running standalone at the moment.

Thanks,

-Richard



--
To unsubscribe:   mailto:[EMAIL PROTECTED]
For additional commands: mailto:[EMAIL PROTECTED]
Troubles with the list: mailto:[EMAIL PROTECTED]

Re: Assistance please - fixed W2k 4.0 vs 4.0.1 problem, created another!

2001-12-18 Thread Richard S. Huntrods


Richard,

I don't mess with CLASSPATH or the copying the jar files to
JDK/jre/lib/ext directory.  I use JBuilder 5 Personal to compile my
java
classes.  That way you just point the IDE to the libs that you want to
include in the project.  You can tell the IDE to use the jar's that
Tomcat is currently using without copying them to another directory (as

well as Struts or anything else you are using).

P.S. JBuilder 5 Personal is free from Borland. :)

Barry

Barry,

Thanks for the info on Borland.  I have 4 professional, due to my
teaching of Java.  You are quite correct about it's handling of class
libraries - it is quite good at that.  I have also got VisualAge 3.2 and
Together 5.  All have many plusses, and some minuses.

In the end, because I wanted a stock compile environment that I could
use on any machine (i.e. W2K or Solaris), I went with the Sun Java SDK
plus a good editor (WinEdit, although Crimson is also good - and free).
The benefit is that anything that compiles on W2K will also compile
exactly the same way on Solaris.  I know there are versions of many
IDE's for Solaris, but I cannot afford the time to learn them at
present.

Thanks again and cheers,

-Richard





--
To unsubscribe:   mailto:[EMAIL PROTECTED]
For additional commands: mailto:[EMAIL PROTECTED]
Troubles with the list: mailto:[EMAIL PROTECTED]

Question on SSL...


Greetings!

I have SSL working with a self-signed certificate on Tomcat 4.0 - on a
Win2K box.  The only difficulty I had was that the jsse jar files had
to be placed in jre/lib/ext, as the JSSE_HOME variable did not work
for me.

Now I am trying to move this work to Solaris.  I have Tomcat 4.0.1
working well on a Solaris (SPARC) box. I duplicated the process of
putting the jar files in the jre/lib/ext directory, and ***copied*** the
self-signed certificate to the same directory (relative to
CATALINA_HOME) as on the W2K box.  I also appropriately edited
server.xml.

Starting Tomcat with the -debug parameter on the Solaris box, I found no
errors.  Likewise, examining the logs reveals no errors, BUT - when I
try to access an html file using port 8443 (the same action worked on
W2K - same directory structures and html files), I get The page cannot
be displayed.  The page displays fine using port 8080.  In other words,
http://xx.xx.xx.xx:8080/index.html; works, but
https://xx.xx.xx.xx:8443/index.html; does not. With the same
certificate, directory structures, jar files (in the JDK/jre/lib/ext
directory), server.xml, etc. on W2K, both work.

Question: MUST you generate the certificate on the box you will use (or
at least the OS)?  I generated the certificate on the W2K box and just
copied it (binary FTP) to the Solaris box.

Thanks in advance,

-Richard



--
To unsubscribe:   mailto:[EMAIL PROTECTED]
For additional commands: mailto:[EMAIL PROTECTED]
Troubles with the list: mailto:[EMAIL PROTECTED]

Assistance please - fixed W2k 4.0 vs 4.0.1 problem, created another!


Greetings!

I have solved my problem on W2K where Tomcat 4.0 worked, but Tomcat
4.0.1 did not.

I simply moved some jar files (most importantly servlet.jar) from
JDK/jre/lib/ext into somewhere else (a temp directory).

Now Tomcat 4.0.1 runs perfectly.  Obviously the occurance of TWO
servlet.jar files was causing all my problems.

BUT - Now I have a new problem, for which I would like to solicit some
advice.

NOW - I cannot compile servlets.  The problem is historic - I hate the
classpath, as almost everyone who tries to use classpath gets into big
trouble - *eventually*.  I teach Java at the University level, and
classpath is a nightmare for students.

But - most of the time you do not need any classpath at all, as Java is
very intelligent about finding what it needs.  Hence my use of the
JDK/jre/lib/ext directory.  This is where Java says to place those jar
files for java extensions (i.e. servlet.jar, junit.jar, mail.jar,
activation.jar, etc...).  AND - javac and java always find them.  Until
Tomcat 4.0.1 (which found them twice G).

Even Tomcat says to put stuff in JDK/jre/lib/ext - specifically this is
one of the two approved methods to get SSL (jsse) working.  In my case,
I had to do this as the JSSE_HOME variable did not get picked up
properly.  Using the jre worked perfectly.

So - how do most people compile servlets, etc if they do not put those
jar files in JDK/jre/lib/ext?  I guess I could use classpath (i.e. in
the compile command line), but I'd really like to find a better
solution.  Until TC 4.0.1's double load of servlet.jar, the
JDK/jre/lib/ext was essentially perfect.

Thanks in advance for any recommendations from all you Java / servlet
developers!

Cheers,

-Richard



--
To unsubscribe:   mailto:[EMAIL PROTECTED]
For additional commands: mailto:[EMAIL PROTECTED]
Troubles with the list: mailto:[EMAIL PROTECTED]

Re: Question on SSL...


Greetings!

Weird.  Here's some more info on my attempts to get SSL working on
Solaris with Tomcat 4.0.1.

In a previous email I mentioned that I generated the .keystore file on
W2K and just copied it to Solaris.

I just tried to generate a .keystore file on Solaris, and got this error
message:

keytool -genkey -alias tomcat -keyalg RSA -keystore
/home/tomcat/keys/.keystore
Enter keystore password: pass
keytool error: KeyPairGenerator not avaliable

(CATALINA_HOME/keys is where I'm storing the keystore files).

This is Solaris 8, full install. The Java SDK is 1.2.2.

Thanks,

-Richard





--
To unsubscribe:   mailto:[EMAIL PROTECTED]
For additional commands: mailto:[EMAIL PROTECTED]
Troubles with the list: mailto:[EMAIL PROTECTED]

Re: Assistance please - fixed W2k 4.0 vs 4.0.1 problem, created another!


Greetings!

Well, I fixed the problem completely!

I checked the jar files I was using in JDK/jre/lib/ext against the ones
in Tomcat 4.0.1, and the file servlet.jar was larger and newer.
Although I'm using JDK 1.3 on my machine, servlet.jar (and a number of
other JAVAX jar files) come from the Sun site as add ins.

I tried replacing my older servlet.jar with the one in
TOMCAT/common/lib, and everything works, including (non-classpath)
compiles!  This is not only great news, but solves all my Tomcat 4.0 /
4.0.1 problems!

So - I would say the key thing here with add on jar files is that
whatever you have in Tomcat library directories MUST BE IDENITCAL with
whatever you have in your JDK, especially the JDK/jre/lib/ext
directory.  I have identical copies of mail.jar, activation.jar and
servlet.jar in both places, and *now that they are identical copies*,
Tomcat 4.0.1 works perfectly.

Cheers,

-Richard



--
To unsubscribe:   mailto:[EMAIL PROTECTED]
For additional commands: mailto:[EMAIL PROTECTED]
Troubles with the list: mailto:[EMAIL PROTECTED]

Try a different approach - What's wrong with catalina.session???

Greetings!

Let's try this again. From the error message below, it would appear
that there is something WRONG with
org.apache.catalina.session.StandardSession. Note from the error that
we get a java.lang.NoSuchMethodError - the method does not exist.

After reading the Catalina Javadocs, it becomes aparent there are two
StandardSessionFacade constructors. One is:

StandardSessionFacade(javax.servlet.http.HttpSession session);
the other is
StandardSessionFacade(org.apache.catalina.session.StandardSession
session)

It would appear that the catalina session version is getting called by
default, because I ask for no specific one in my code. The problem is
that there is NO StandardSession class, according to the javadocs - or
if there is (undocumented), it is missing the putSession method, as
stated in the error.

I think this is a BUG in Catalina. Why call one particular constructor
by default, which does not use the standard javax classes, and then NOT
supply all the required session methods? NOTE - this constructor is
called OUTSIDE my code by other Catalina code - I have no real control
over which constructor is used.

Does anyone in the developmer community know of a workaround?

java.lang.NoSuchMethodError
at
org.apache.catalina.session.StandardSession.setAttribute(StandardSession.java:1185)

at
org.apache.catalina.session.StandardSessionFacade.setAttribute(StandardSessionFacade.java:191)

at
qti.object.Login.putSession(Login.java:572)

--
To unsubscribe: mailto:[EMAIL PROTECTED]
For additional commands: mailto:[EMAIL PROTECTED]
Troubles with the list: mailto:[EMAIL PROTECTED]

Re: Try a different approach - What's wrong with catalina.session???


More stuff

Here is the source code to a servlet that RUNS under Tomcat 4.0 but does
NOT RUN under Tomcat 4.0.1.

I can email (upone request) a zip file containing the full directory
structure (with class file) that can be unzipped an placed directly
under webapps.  Put it in Tomcat 4.0 and it runs, put it under Tomcat
4.0.1 and it does not.

Of course - tc 4.0 and tc 4.0.1 are in totally separate directories, can
run all example servlets AND any servlet without the session stuff in
it.  Also of course I never try to run TC4 and 4.01 at the same time.
On Solaris 8, this runs under tc 4.0.1 without error.  Only on Win 2000
does this error happen.

I have also re-downloaded Tomcat for Windows and done a binary compare
between what I have and the latest - and they are identical.

It really does seem as if TC 4.0.1 on W2K has a problem with the
catalina.StandardSesionFacade incorrectly calling
catalina.StandardSession instead of javax.servlet.http.HttpSession,
but I do not know why this happens on W2K but NOT on Solaris.

I am not a newbie in this particular stuff, and have done my
homework.  I would appreciate a reply from someone in the Tomcat
developer community.

Cheers,

-Richard

=the code==
/**
 * Title: SessionTestServlet
 *
 * Description: Session Test Servlet - duplicate Catalina Session error
 *
 * Copyright: Copyright (c) 2001, Huntrods Consulting Inc.
 *
 * Company: Huntrods Consulting Inc.
 * Author: Richard S. Huntrods
 * Version: 1.0
 * Date: December 13, 2001
 *
 * @author Richard S. Huntrods
 * @version 1.0
 */

package testing;

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
import java.util.*;

public class SessionTestServlet extends HttpServlet {
public void init(ServletConfig config) throws ServletException {
super.init(config);
}

public void doGet(HttpServletRequest request, HttpServletResponse
response)
throws ServletException, IOException {

doPost(request, response);
}

public void doPost(HttpServletRequest request, HttpServletResponse
response)
throws ServletException, IOException {

response.setContentType (text/html);
StringBuffer buffer = new StringBuffer();

HttpSession session = request.getSession(true);
if(session != null) {
session.setAttribute(name, Richard Huntrods);
session.setAttribute(company, Huntrods Consulting Inc.);

}

buffer.append(HTML\n);
buffer.append(HEAD\n);
buffer.append( META NAME=\GENERATOR\ CONTENT=\WinEdit -
Richard S. Huntrods\\n);
buffer.append( TITLESession Test/TITLE\n);
buffer.append(/HEAD\n);
buffer.append(BODY BGCOLOR=\#99\\\n);
buffer.append( PCENTERBIH2\n);
buffer.append(Session Test\n);
buffer.append( /H2/I/B/CENTER/P\n);
buffer.append(/BODY\n);
buffer.append(/HTML\n);

PrintWriter out = response.getWriter();
out.println(buffer);
out.close();
}

public String getServletInfo() {
return SessionTestServlet Information;
}
}
=





--
To unsubscribe:   mailto:[EMAIL PROTECTED]
For additional commands: mailto:[EMAIL PROTECTED]
Troubles with the list: mailto:[EMAIL PROTECTED]

Re: Try a different approach - What's wrong with catalina.session??


Hmmm

the difference between these two constructors is, that the one which
takes a
StandardSession upcasts it to HttpSession before assigning it to it's
session attribute,
this should not cause this problem, as StandardSession does implement
all
HttpSession methods (otherwise the compiler would want to have it
declared
abstract).
.
From my (I confess very distant) position it looks like a jvm on W2K
problem. Especially because you say it does work on Solaris.

Mika

EXACTLY!  That is what I think as well, except... Both TC 4.0 and TC
4.0.1 are on the same machine.  I have read all the release notes with
both versions, and cannot find anywhere that suggests a difference in
how the JVM is found / used.  In fact, the batch file I created to run
tc 4.0 and to run 4.0.1 is identical (i.e. JAVA_HOME) except for the
location of the bin files that actually start Tomcat.

So - if you or anyone knows of differences in how TC 4.0 vs. 4.0.1
find/load/use things like the servlet .jar files in JAVA_HOME vs. the
Tomcat libraries, I'd like to know.


-Richard





--
To unsubscribe:   mailto:[EMAIL PROTECTED]
For additional commands: mailto:[EMAIL PROTECTED]
Troubles with the list: mailto:[EMAIL PROTECTED]

Re: Try a different approach - What's wrong with catalina.session???


Greetings!

Craig said...

This kind of problem indicates that your Tomcat installation is somehow

corrupted.  If it were really a bug, it would be happening to everyone,

not just to you.

I suggest that you do the following:

* Make sure you do not have anything in $JAVA_HOME/jre/lib/ext
 (most *especially* not things like servlet.jar or j2ee.jar,
 which are *guaranteed* to cause nothing but grief)

RSH: WHY?  That is where you put these files to allow you to compile
code.  Why should it cause Tomcat grief (esp. NOT 4.0 but only 4.0.1)
unless the Tomcat jar loader code is now broken?


* Do a clean installation of Tomcat 4 into a new directory.

RSH: Done 3 times, downloaded new binaries 2 times, did binary
comparisons of all copies of 4.0.1 - all the same every time.  That is
NOT the problem.

* Make sure that all the examples work (including the ones that
  use sessions)

RSH: Which ones are the session ones?  I tried 1/2 dozen examples, all
worked.


* Install your applications and test.

We're now down to the simple servlet I sent to this list.  Why doesn't
someone with 4.0.1 on W2K compile it and try it.  If it runs, then tell
me which version of the Sun Java SDK you have, and what is inside
.../jre/lib/ext ?  And, if servlet.jar is NOT in that directory, how the
heck did they get my servlet to compile with the SDK? (Using JBuilder is
cheatingG).

-Richard


Craig McClanahan





--
To unsubscribe:   mailto:[EMAIL PROTECTED]
For additional commands: mailto:[EMAIL PROTECTED]
Troubles with the list: mailto:[EMAIL PROTECTED]

Re: Try a different approach - What's wrong with catalina.session???