Re: Securing Tomcat Context Descriptor

2005-08-20 Thread Peter Rossbach
I thing you can use the Java Security Manager and OS level file permisssion for this or wrote your own DataSource JNDI Factory. Peter Brett Parsons schrieb: Hi All, There is a requirement on the server that we have Tomcat 5.0.28 deployed that no username/password information can be stored

Re: Problem VirtualHost WebApp Served on Two URLs

2005-08-20 Thread Peter Rossbach
You must rename your directory from mysite to ROOT. Context docBase=c:\sites\www.mysite.com\ROOT path= reloadable=true source=com.ibm.wtp.web.server:mysite/ Peter TroyGeek schrieb: I have a problem with Tomcat Virtual Hosting. I have my virtual host defined like so in server.xml (the

Re: persistence with sessions distributable attribute

2005-08-20 Thread Christoph Kutzinski
Nishant Deshpande wrote: The SessionListener can check if the attribute implements Serializable, not if it actually is serializable. i.e. Nothing to stop people from storing objects which implement serializable but will barf when actually are serialized. That is not exactly true. Look at my

Re: refusing low-grade SSL connections

2005-08-20 Thread Mark Thomas
Set the ciphers attribute on the connector. See http://jakarta.apache.org/tomcat/tomcat-5.5-doc/config/http.html Mark Paul Singleton wrote: According to the OWASP Web Application Penetration Checklist (available from www.owasp.org), a secure application server should: * Ensure that

Re: Securing Tomcat Context Descriptor

2005-08-20 Thread Mark Thomas
A couple of observations: - If someone can read the context descriptor they pretty much own Tomcat and probably the server as well. If this person is unauthorised, you have big problems regardless of whether or not they have read-only access to the database. - If the password is encrypted,

Re: Unable to access application if I am on VPN

2005-08-20 Thread Len Popp
Can you download the DTD to the server and point the config file at the local copy? That must be possible, otherwise you couldn't run an application on an intranet that's not connected to the WWW. -- Len On 8/19/05, Martin Wood [EMAIL PROTECTED] wrote: So, i think the issue is getting tomcat

Re: Unable to access application if I am on VPN

2005-08-20 Thread Brian Cook
Hm Could you configure the firewall to reroute the JVM request thought the proxy? Len Popp wrote: Can you download the DTD to the server and point the config file at the local copy? That must be possible, otherwise you couldn't run an application on an intranet that's not connected to

FW: Unable to access application if I am on VPN

2005-08-20 Thread Hayes, Wes
-Original Message- From: Brian Cook [mailto:[EMAIL PROTECTED] Sent: Saturday, August 20, 2005 10:04 AM To: Tomcat Users List Subject: Re: Unable to access application if I am on VPN Hm Could you configure the firewall to reroute the JVM request thought the proxy? Len Popp

Can't get apache to connect to tomcat

2005-08-20 Thread Jonathan August
I'm trying to get requests going to www.mydomain.com/servlets/ to get handed off to tomcat. I have the mod_jk module loaded: Apache/2.0.54 (Unix) mod_ssl/2.0.54 OpenSSL/0.9.7f mod_jk/1.2.14 Server at www.mydomain.com Port 80 and I get the Tomcat/5.0.28 welcome screen when I go to:

Re: Unable to access application if I am on VPN

2005-08-20 Thread Wade Chandler
--- Brian Cook [EMAIL PROTECTED] wrote: Hm Could you configure the firewall to reroute the JVM request thought the proxy? Len Popp wrote: Can you download the DTD to the server and point the config file at the local copy? That must be possible, otherwise you couldn't run