Re: Installing the OWF webapp to an existing Tomcat Instance

2014-02-25 Thread Mark Thomas
On 24/02/2014 23:46, J. Brian Hall 2. Log files. Yes, the webapp fails to initialize. Here's the first few lines: ERROR org.springframework.web.context.ContextLoader - Context initialization failed org.springframework.beans.factory.BeanCreationException: Error creating bean with name

[SECURITY] CVE-2014-0033 Session fixation still possible with disableURLRewriting enabled

2014-02-25 Thread Mark Thomas
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2014-0033 Session fixation still possible with disableURLRewriting enabled Severity: Low Vendor: The Apache Software Foundation Versions Affected: - - Apache Tomcat 6.0.33 to 6.0.37 Description: Previous fixes to path parameter handling [1]

[SECURITY] CVE-2013-4322 Incomplete fix for CVE-2012-3544 (Denial of Service)

2014-02-25 Thread Mark Thomas
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2013-4322 Incomplete fix for CVE-2012-3544 (Denial of Service) Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Apache Tomcat 8.0.0-RC1 to 8.0.0-RC5 - - Apache Tomcat 7.0.0 to 7.0.47 - - Apache Tomcat 6.0.0 to

[SECURITY] CVE-2013-4590 Information disclosure via XXE when running untrusted web applications

2014-02-25 Thread Mark Thomas
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2013-4590 Information disclosure via XXE when running untrusted web applications Severity: Low Vendor: The Apache Software Foundation Versions Affected: - - Apache Tomcat 8.0.0-RC1 to 8.0.0-RC5 - - Apache Tomcat 7.0.0 to 7.0.47 - - Apache

[SECURITY] CVE-2013-4286 Incomplete fix for CVE-2005-2090 (Information disclosure)

2014-02-25 Thread Mark Thomas
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2013-4286 Incomplete fix for CVE-2005-2090 (Information disclosure) Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Apache Tomcat 8.0.0-RC1 - - Apache Tomcat 7.0.0 to 7.0.42 - - Apache Tomcat 6.0.0 to 6.0.37

RE: Installing the OWF webapp to an existing Tomcat Instance

2014-02-25 Thread J. Brian Hall
Mark, -Original Message- From: Mark Thomas [mailto:ma...@apache.org] Sent: Tuesday, February 25, 2014 3:34 AM To: Tomcat Users List Subject: Re: Installing the OWF webapp to an existing Tomcat Instance On 24/02/2014 23:46, J. Brian Hall 2. Log files. Yes, the webapp fails to

how to best launch a jnlp from and then return to a different jsp

2014-02-25 Thread Aryeh Friedman
We need to launch (via a jsp page) a JNLP from a jsp template (already in production) and do some task of some long time (filling out a form and then uploading via non-JSP mechanisms a large file [between 5MB and 50MB]... this is also in production) what we do not have and want to add is when the

RE: Installing the OWF webapp to an existing Tomcat Instance

2014-02-25 Thread J. Brian Hall
Chris, -Original Message- From: Christopher Schultz [mailto:ch...@christopherschultz.net] Sent: Tuesday, February 25, 2014 1:01 AM To: Tomcat Users List Subject: Re: Installing the OWF webapp to an existing Tomcat Instance -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Brian, On

RE: Installing the OWF webapp to an existing Tomcat Instance

2014-02-25 Thread J. Brian Hall
Mikolaj, -Original Message- From: Mikolaj Rydzewski [mailto:m...@ceti.pl] Sent: Tuesday, February 25, 2014 2:52 AM To: Tomcat Users List Subject: RE: Installing the OWF webapp to an existing Tomcat Instance On 25.02.2014 00:46, J. Brian Hall wrote: ERROR

Re: how to best launch a jnlp from and then return to a different jsp

2014-02-25 Thread Mikolaj Rydzewski
On 25.02.2014 13:18, Aryeh Friedman wrote: We need to launch (via a jsp page) a JNLP from a jsp template (already in production) and do some task of some long time (filling out a form and then uploading via non-JSP mechanisms a large file [between 5MB and 50MB]... this is also in production)

RE: Installing the OWF webapp to an existing Tomcat Instance

2014-02-25 Thread Mikolaj Rydzewski
On 25.02.2014 13:22, J. Brian Hall wrote: Feb 24, 2014 7:14:28 PM org.apache.coyote.AbstractProtocol init SEVERE: Failed to initialize end point associated with ProtocolHandler [http-apr-8443] java.lang.Exception: Connector attribute SSLCertificateFile must be defined when using SSL with APR

Re: how to best launch a jnlp from and then return to a different jsp

2014-02-25 Thread Aryeh Friedman
since this is an intranet application the two are one in the same (assume they have already accepted the jar signings and such) On Tue, Feb 25, 2014 at 7:32 AM, Mikolaj Rydzewski m...@ceti.pl wrote: On 25.02.2014 13:18, Aryeh Friedman wrote: We need to launch (via a jsp page) a JNLP from a

Re: how to best launch a jnlp from and then return to a different jsp

2014-02-25 Thread Mikolaj Rydzewski
On 25.02.2014 13:40, Aryeh Friedman wrote: since this is an intranet application the two are one in the same (assume they have already accepted the jar signings and such) Web application (on tomcat) does not have any control on application that was started via jnlp. They are separate. --

Re: Newbie Help - Up and Running with Tomcat on Windows

2014-02-25 Thread Daniel Mikusa
On Feb 25, 2014, at 2:02 AM, Bruce Whealton br...@futurewaveonline.com wrote: Hello all, I have had a difficult time getting Tomcat to start. I first tried installing it with xampp. I had a hunch that the problem was that there might be a port conflict, so I tried a different

port-offset

2014-02-25 Thread Ja kub
Hi Do you know if in Tomcat is something similar to jboss port-offset ? -Djboss.socket.binding.port-offset=100 It would be convinient for starting several tomcats on the same operating system. No need to change ports in server.xml BR Jakub

Re: how to best launch a jnlp from and then return to a different jsp

2014-02-25 Thread Aryeh Friedman
Even if there is a way for the jnlp to leave a cookie on the server? On Tue, Feb 25, 2014 at 7:48 AM, Mikolaj Rydzewski m...@ceti.pl wrote: On 25.02.2014 13:40, Aryeh Friedman wrote: since this is an intranet application the two are one in the same (assume they have already accepted the jar

RE: Tomcat upgrades/security patching best practises

2014-02-25 Thread Paul Beckett
I can't tell how much easier it is to manage Tomcat installations (even small ones) with these two separated: Tomcat base install goes one place, your configuration and everything you need goes another. Upgrades are as simply as changing the CATALINA_HOME path, and downgrades (if necessary)

Re: port-offset

2014-02-25 Thread Konstantin Kolinko
2014-02-25 16:55 GMT+04:00 Ja kub jjaku...@gmail.com: Hi Do you know if in Tomcat is something similar to jboss port-offset ? -Djboss.socket.binding.port-offset=100 It would be convinient for starting several tomcats on the same operating system. No need to change ports in server.xml

Re: how to best launch a jnlp from and then return to a different jsp

2014-02-25 Thread Aryeh Friedman
Let me better explain the application there are some large files that remote users need to upload for ananylsis (and then down load the reports several hours later)... due the nature of the data (security and otherwise) the client decided to by pass the web completely for the actual upload but

Re: how to best launch a jnlp from and then return to a different jsp

2014-02-25 Thread Mikolaj Rydzewski
On 25.02.2014 13:57, Aryeh Friedman wrote: Even if there is a way for the jnlp to leave a cookie on the server? You're wrong. Jnlp won't leave a cookie on the server. Server may ask client to store the cookie. Jnlp is just a file. It tells JVM what jars are required for application to run.

Re: how to best launch a jnlp from and then return to a different jsp

2014-02-25 Thread Aryeh Friedman
Have you ever heard of metaphores obviously there are not server side cookies I meant a cookie file (aka sential or whatever) that just shows the upload completed and the webapp can use that as a status check On Tue, Feb 25, 2014 at 8:02 AM, Mikolaj Rydzewski m...@ceti.pl wrote: On 25.02.2014

RE: Installing the OWF webapp to an existing Tomcat Instance

2014-02-25 Thread Caldarale, Charles R
From: J. Brian Hall [mailto:jbrianhall...@me.com] Subject: RE: Installing the OWF webapp to an existing Tomcat Instance Connector port=8443 protocol=HTTP/1.1 SSLEnabled=true maxThreads=150 scheme=https secure=true keystoreFile=certs/keystore.jks keystorePass=changeit clientAuth=want

RE: Installing the OWF webapp to an existing Tomcat Instance

2014-02-25 Thread J. Brian Hall
Mikolaj, -Original Message- From: Mikolaj Rydzewski [mailto:m...@ceti.pl] Sent: Tuesday, February 25, 2014 7:35 AM To: Tomcat Users List Subject: RE: Installing the OWF webapp to an existing Tomcat Instance On 25.02.2014 13:22, J. Brian Hall wrote: Feb 24, 2014 7:14:28 PM

Re: how to best launch a jnlp from and then return to a different jsp

2014-02-25 Thread chris derham
Aryeh, I suggest that you take a step from implementations, and define what you want a little more clearly. You have a webpage, that is served and loads a java app via jnlp. That java app uploads some files to the server. At a later point in time, you want the server to know that the client has

Re: Tomcat upgrades/security patching best practises

2014-02-25 Thread Mark Thomas
On 25/02/2014 12:58, Paul Beckett wrote: I can't tell how much easier it is to manage Tomcat installations (even small ones) with these two separated: Tomcat base install goes one place, your configuration and everything you need goes another. Upgrades are as simply as changing the

Re: Tomcat upgrades/security patching best practises

2014-02-25 Thread Daniel Mikusa
On Feb 25, 2014, at 7:58 AM, Paul Beckett paul_beck...@outlook.com wrote: I can't tell how much easier it is to manage Tomcat installations (even small ones) with these two separated: Tomcat base install goes one place, your configuration and everything you need goes another. Upgrades are as

Re: how to best launch a jnlp from and then return to a different jsp

2014-02-25 Thread Aryeh Friedman
1. Your use case is correct except that it is entire SD cards (including the file system structure) 1. For security reasons that is a bad idea (essentially it is not HIPAA complaint) to have the server know before hand what data it will be receiving and for whom (besides the filenames themselves

RE: Installing the OWF webapp to an existing Tomcat Instance

2014-02-25 Thread J. Brian Hall
Chuck, you are THE MAN! That was it. No log file now for the owf webapp. It successfully initializes. Also, when accessing owf from http://localhost:8080/manager/html, I'm successfully prompted for certificates and redirected to https://localhost:8443/owf One other kink I tried to work-out.

Re: Installing the OWF webapp to an existing Tomcat Instance

2014-02-25 Thread Leo Donahue
On Tue, Feb 25, 2014 at 7:17 AM, J. Brian Hall jbrianhall...@me.com wrote: Chuck, you are THE MAN! +1 One other kink I tried to work-out. When I go to https://localhost:8443/owf, I get the following common message: There is a problem with this website's security certificate. The security

Re: Installing the OWF webapp to an existing Tomcat Instance

2014-02-25 Thread Leo Medina
UNSUBSCRIBE On Mon, Feb 24, 2014 at 3:46 PM, J. Brian Hall jbrianhall...@me.com wrote: Hey Chuck, thanks (I was worried someone would yell at me for posting this question here). Responses are below ... -Original Message- From: Caldarale, Charles R

Re: Newbie Help - Up and Running with Tomcat on Windows

2014-02-25 Thread Howard W. Smith, Jr.
On Tue, Feb 25, 2014 at 7:55 AM, Daniel Mikusa dmik...@gopivotal.comwrote: It might be something as obvious as not having Java EE installed separately. Perhaps Tomee+ will provide all that is needed. What specifically do you need? Tomcat is not a full JEE container. It

RE: Tomcat 7.0.50 tldValidation

2014-02-25 Thread Paul Beckett
Date: Wed, 22 Jan 2014 15:15:53 + From: ma...@apache.org To: users@tomcat.apache.org Subject: Re: Tomcat 7.0.50 tldValidation On 22/01/2014 14:12, Paul Beckett wrote: Does anyone know: - Why this occurs only since 7.0.50 Changes to XML validation introduced in 7.0.48-7.0.50 -

Re: Issue running Websockets JSR356 with Tomcat 7.0.50 Embedded

2014-02-25 Thread Jacopo Cappellato
Any hints? I would really appreciate if someone could provide some pointers (e.g. classes involved etc) about the implementation of the mechanism used to discover and deploy endpoints; I will then try to study the code in order to figure out why it doesn't work when I set

Re: Tomcat/Java Spring MVC 2.0/c3p0 - Consultant needed

2014-02-25 Thread Charles Richard
Hi, On Tue, Feb 25, 2014 at 1:26 AM, Christopher Schultz ch...@christopherschultz.net wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Charles, On 2/24/14, 10:15 AM, Charles Richard wrote: Sorry if this is not the right forum for this kind of inquiry. I figure the best

Re: Issue running Websockets JSR356 with Tomcat 7.0.50 Embedded

2014-02-25 Thread Mark Thomas
On 25/02/2014 15:14, Jacopo Cappellato wrote: Any hints? I would really appreciate if someone could provide some pointers (e.g. classes involved etc) about the implementation of the mechanism used to discover and deploy endpoints; I will then try to study the code in order to figure out why it

Re: Issue running Websockets JSR356 with Tomcat 7.0.50 Embedded

2014-02-25 Thread Jacopo Cappellato
On Feb 25, 2014, at 4:20 PM, Mark Thomas ma...@apache.org wrote: On 25/02/2014 15:14, Jacopo Cappellato wrote: Any hints? I would really appreciate if someone could provide some pointers (e.g. classes involved etc) about the implementation of the mechanism used to discover and deploy

Re: Newbie Help - Up and Running with Tomcat on Windows

2014-02-25 Thread Daniel Mikusa
On Feb 25, 2014, at 10:13 AM, Howard W. Smith, Jr. smithh032...@gmail.com wrote: On Tue, Feb 25, 2014 at 7:55 AM, Daniel Mikusa dmik...@gopivotal.comwrote: It might be something as obvious as not having Java EE installed separately. Perhaps Tomee+ will provide all that is needed.

Re: Tomcat/Java Spring MVC 2.0/c3p0 - Consultant needed

2014-02-25 Thread Daniel Mikusa
On Feb 25, 2014, at 10:14 AM, Charles Richard charle...@thelearningbar.com wrote: Hi, On Tue, Feb 25, 2014 at 1:26 AM, Christopher Schultz ch...@christopherschultz.net wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Charles, On 2/24/14, 10:15 AM, Charles Richard wrote:

Re: Newbie Help - Up and Running with Tomcat on Windows

2014-02-25 Thread Howard W. Smith, Jr.
On Tue, Feb 25, 2014 at 10:30 AM, Daniel Mikusa dmik...@gopivotal.comwrote: On Feb 25, 2014, at 10:13 AM, Howard W. Smith, Jr. smithh032...@gmail.com wrote: On Tue, Feb 25, 2014 at 7:55 AM, Daniel Mikusa dmik...@gopivotal.com wrote: It might be something as obvious as not

Re: Tomcat/Java Spring MVC 2.0/c3p0 - Consultant needed

2014-02-25 Thread Charles Richard
On Tue, Feb 25, 2014 at 11:37 AM, Daniel Mikusa dmik...@gopivotal.comwrote: On Feb 25, 2014, at 10:14 AM, Charles Richard charle...@thelearningbar.com wrote: Hi, On Tue, Feb 25, 2014 at 1:26 AM, Christopher Schultz ch...@christopherschultz.net wrote: -BEGIN PGP SIGNED

RE: Newbie Help - Up and Running with Tomcat on Windows

2014-02-25 Thread Bruce Whealton
Thanks for the response, Daniel. At this point, I don't know if I would need more of the JEE container. Perhaps when I learn more I'll find a need for more services and features. I know that one app I had in mind to install on my server, would run in a Tomcat environment (not sure if that is

Re: Tomcat/Java Spring MVC 2.0/c3p0 - Consultant needed

2014-02-25 Thread Daniel Mikusa
On Feb 25, 2014, at 10:50 AM, Charles Richard charle...@thelearningbar.com wrote: On Tue, Feb 25, 2014 at 11:37 AM, Daniel Mikusa dmik...@gopivotal.comwrote: On Feb 25, 2014, at 10:14 AM, Charles Richard charle...@thelearningbar.com wrote: Hi, On Tue, Feb 25, 2014 at 1:26 AM,

RE: tomcat 6 refuses mod_jk connections after server runs for a couple of days

2014-02-25 Thread Isaac Gonzalez
Hi Christopher thanks so much for your replies..., I am responding with inline comments below From: Christopher Schultz [ch...@christopherschultz.net] Sent: Monday, February 24, 2014 9:56 PM To: Tomcat Users List Subject: Re: tomcat 6 refuses mod_jk

RE: Installing the OWF webapp to an existing Tomcat Instance

2014-02-25 Thread J. Brian Hall
Leo, -Original Message- From: Leo Donahue [mailto:donahu...@gmail.com] Sent: Tuesday, February 25, 2014 9:44 AM To: Tomcat Users List Subject: Re: Installing the OWF webapp to an existing Tomcat Instance On Tue, Feb 25, 2014 at 7:17 AM, J. Brian Hall jbrianhall...@me.com wrote: Chuck,

Getting Apache Tomcat logs in mail

2014-02-25 Thread Randeep
Hi, Is there any way to get exceptions mailed? I have an apache tomcat 6.0.37 with httpd as front end connected with mod_jk. I have 5-6 web applications hosted in my tomcat. So I get a lot of logs. And the applications are big so tracking each and everything is a little bit tiring. Is there

Re: Getting Apache Tomcat logs in mail

2014-02-25 Thread Daniel Mikusa
On Feb 25, 2014, at 1:25 PM, Randeep randeep...@gmail.com wrote: Hi, Is there any way to get exceptions mailed? I have an apache tomcat 6.0.37 with httpd as front end connected with mod_jk. I have 5-6 web applications hosted in my tomcat. So I get a lot of logs. And the applications are

RE: Tomcat 7.0.37 issue on our Sun Sparc

2014-02-25 Thread Jay
Hi Chris, Thanks for your comments and suggestion. The other files in the logs don't seem to have more useful info: catalina.2014-02-19.log host-manager.2014-02-19.log localhost.2014-02-19.log localhost_access_log.2014-02-19.txt manager.2014-02-19.log JVM looks ok and doesn't seems crashed. We

Re: Installing the OWF webapp to an existing Tomcat Instance

2014-02-25 Thread Leo Donahue
On Tue, Feb 25, 2014 at 10:57 AM, J. Brian Hall jbrianhall...@me.com wrote: Leo, -Original Message- From: Leo Donahue [mailto:donahu...@gmail.com] Sent: Tuesday, February 25, 2014 9:44 AM To: Tomcat Users List Subject: Re: Installing the OWF webapp to an existing Tomcat Instance

Re: Tomcat 7.0.37 issue on our Sun Sparc

2014-02-25 Thread Konstantin Kolinko
2014-02-24 22:42 GMT+04:00 Jay mx...@live.com: Hi Mark, Thank you for a quick response. It looks the Tomcat 7.0.37 is ok with Solaris 10 on other Sun Sparc machine ... could it be hardware related? Do you have any suggestion for us to capture that possible Shutdown command and/or possible

Re: tomcat 6 refuses mod_jk connections after server runs for a couple of days

2014-02-25 Thread Konstantin Kolinko
2014-02-24 23:27 GMT+04:00 Isaac Gonzalez igonza...@autoreturn.com: Hello all, I'm running tomcat 6.0.32 Can you upgrade to 6.0.39 or 7.0.52? on Cent OS 6 with 2 front end apache load balancers with a firewall in between the tomcat and load balancers A firewall between Apache HTTPD Server

Re: Issue running Websockets JSR356 with Tomcat 7.0.50 Embedded

2014-02-25 Thread Konstantin Kolinko
2014-02-25 19:14 GMT+04:00 Jacopo Cappellato jacopo.cappell...@gmail.com: Any hints? I would really appreciate if someone could provide some pointers (e.g. classes involved etc) about the implementation of the mechanism used to discover and deploy endpoints; I will then try to study the code

Re: Tomcat 7.0.50 tldValidation

2014-02-25 Thread Konstantin Kolinko
2014-01-22 18:12 GMT+04:00 Paul Beckett paul_beck...@outlook.com: I've recently upgraded some of our tomcats from 7.0.47 to 7.0.50. After upgrading I got lots of the below errors recorded in catalina.out The errors are not logged if I disable tldValidation (either by settings

RE: tomcat 6 refuses mod_jk connections after server runs for a couple of days

2014-02-25 Thread Isaac Gonzalez
Hi Konstantin, I can try to upgrade to tomcat 6.0.39 or tomcat 7...It should be a simple enough upgradewould possibly help out a bit. I have the worker.basic.socket_keepalive=True set so according to the tomcat connector documentation, this should help with the firewall dropping open

RE: Tomcat/Java Spring MVC 2.0/c3p0 - Consultant needed

2014-02-25 Thread Martin Gainty
I assume based on all the wonderful experiences the states have experienced in last dozen years that Canada has wised up and stopped Americans from sneaking across the border without a passport? better pack you snowshoes..they have about 6 feet of snow (last time i checked) Keep me

RE: Tomcat 7.0.50 tldValidation

2014-02-25 Thread Paul Beckett
Konstantin,Thanks this has fixed it for me. I've recently upgraded some of our tomcats from 7.0.47 to 7.0.50. After upgrading I got lots of the below errors recorded in catalina.out The errors are not logged if I disable tldValidation (either by settings tldValidation=false in context.xml