Re: Tomcat log warnings for connection parameter limits?

2024-04-11 Thread Baron Fujimoto
I was thinking it would be something that would be left on in a live system. We can set these parameters, so it would be useful to know if we were hitting the set limits. I'm not sure I fully grasp how this additional logging presents a significant incremental DOS risk. I mean, if an attacker is

Re: Retrieve server.built, server.number

2024-04-11 Thread Mark Thomas
On 11/04/2024 15:49, Bill Stewart wrote: On Wed, Apr 10, 2024 at 2:14 PM Mark Thomas wrote: ... and it might represent an information leakage vulnerability in your application. Be Careful. Shall we start the flame war now on whether exposing the current version you are running

Package URLs for Apache Tomcat distributions

2024-04-11 Thread von Loewenstein, Jan
Hi folks, I am part of the Paketo community, and we are providing Cloud Native Buildpacks to create container images with – amongst other technologies – Apache Tomcat and Apache TomEE as application runtimes. One of the features of Cloud Native Buildpacks is that images come with

Re: [OT] Tomcat 9.0.83 - SSL handshake stops working for Google API calls after a while

2024-04-11 Thread Christopher Schultz
Marcos, On 4/11/24 09:52, Marcos Peña wrote: Thanks for your replies. My bad assuming the connector configuration applied to all connections but it makes total sense that applies to incoming connections. That helps a lot. I have been trying to solve this problem for several days and I was a

RE: [EXT]Re: Tomcat 10 session replication fails

2024-04-11 Thread Rick Noel
Thanks Chuck, We are getting closer Changing ports from the 5000 range to the 4000 range stopped two errors But now I get this.. INFO: Manager [##0001]: skipping state transfer. No members active in cluster group How to I make the member machine in the cluster active? Rick Noel

Re: [OT] Tomcat 9.0.83 - SSL handshake stops working for Google API calls after a while

2024-04-11 Thread Marcos Peña
Thanks for your replies. My bad assuming the connector configuration applied to all connections but it makes total sense that applies to incoming connections. That helps a lot. I have been trying to solve this problem for several days and I was a bit desperate. I could not find anything in the

Re: [OT] Tomcat 9.0.83 - SSL handshake stops working for Google API calls after a while

2024-04-11 Thread Chuck Caldarale
> On Apr 11, 2024, at 07:28, Marcos Peña wrote: > > I am looking for help with a strange issue we are experiencing when trying to > use Google APIs from a web application that is deployed on Tomcat 9.0.83. As Chris noted, this has nothing to do with Tomcat. The stack trace shows that the

Re: Retrieve server.built, server.number

2024-04-11 Thread Bill Stewart
On Wed, Apr 10, 2024 at 2:14 PM Mark Thomas wrote: > ... and it might represent an information leakage vulnerability in your > > application. Be Careful. > > Shall we start the flame war now on whether exposing the current version > you are running represents a valid vulnerability or if hiding

Re: [OT] Tomcat 9.0.83 - SSL handshake stops working for Google API calls after a while

2024-04-11 Thread Christopher Schultz
Marcos, Marking as "off topic" because this is not Tomcat-related. Please see below... On 4/11/24 08:28, Marcos Peña wrote: Hi, I am looking for help with a strange issue we are experiencing when trying to use Google APIs from a web application that is deployed on Tomcat 9.0.83. After a

Re: Tomcat 9.0.83 - SSL handshake stops working for Google API calls after a while

2024-04-11 Thread Simon Matter
Hi, > Hi, > > I am looking for help with a strange issue we are experiencing when trying > to use Google APIs from a web application that is deployed on Tomcat > 9.0.83. > > After a few hours of the server being up and running, all calls to the > Google APIs fail because of SSL handshake errors.

Re: Tomcat 10 session replication fails

2024-04-11 Thread Chuck Caldarale
> On Apr 11, 2024, at 07:56, Rick Noel wrote: > > We have our app running on Tomcat10 and doing clustering,but are getting the > following errors seen int the Catalina log... > > Apr 11, 2024 8:14:43 AM org.apache.catalina.ha.session.DeltaManager > waitForSendAllSessions > SEVERE:

Tomcat 10 session replication fails

2024-04-11 Thread Rick Noel
Hi, We have our app running on Tomcat10 and doing clustering,but are getting the following errors seen int the Catalina log... Apr 11, 2024 8:14:43 AM org.apache.catalina.ha.session.DeltaManager waitForSendAllSessions SEVERE: Manager [##0001]: No session state sent at [4/11/24, 8:13 AM]

Tomcat 9.0.83 - SSL handshake stops working for Google API calls after a while

2024-04-11 Thread Marcos Peña
Hi, I am looking for help with a strange issue we are experiencing when trying to use Google APIs from a web application that is deployed on Tomcat 9.0.83. After a few hours of the server being up and running, all calls to the Google APIs fail because of SSL handshake errors. Attaching the SSL

Re: Retrieve server.built, server.number

2024-04-11 Thread Christopher Schultz
Mark, On 4/10/24 16:12, Mark Thomas wrote: On 10/04/2024 21:15, Christopher Schultz wrote: All, On 4/10/24 4:00 AM, Mark Thomas wrote: On 09/04/2024 17:17, prat 007 wrote: Hi All, I would like to know is there a way to find tomcat's server.built and server.number remotely using tool loke

Re: Tomcat log warnings for connection parameter limits?

2024-04-11 Thread Christopher Schultz
Baron, On 4/9/24 16:33, Baron Fujimoto wrote: I'm investigating occasional 503 errors for our CAS service running in a Tomcat 10.1.x container. The 503s appear to correlate with some traffic spikes at the same time. The connector is configured as follows: Can Tomcat log info such as