Configure application with optional security restrictions

2015-06-08 Thread AHartner
I would like to be able to configure a web application with optional 
security restrains. Basically I only want the application to be secured 
only if an external setting such as a realm is present or application 
context parameter is set.


In secure mode I want to use form based authentication as defined in the 
web.xml in the usual way.


In unsecured mode I want to allow all access to the application.

I know how to update server.xml and web.xml to achieve both 
independently, but I am looking for toggle to allow me to control the 
operations mode outside of the application.


Would it work to create a realm which always allows access and then 
configure either a proper authenticating or a less-proper allow-all 
realm in the server.xml file ? Would this still prompt users for access ?


Any other suggestions on this ?

Kind regards


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Configure application with optional security restrictions

2015-06-08 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

AHartner,

On 6/8/15 3:45 PM, AHartner wrote:
 I would like to be able to configure a web application with
 optional security restrains. Basically I only want the application
 to be secured only if an external setting such as a realm is
 present or application context parameter is set.
 
 In secure mode I want to use form based authentication as defined
 in the web.xml in the usual way.
 
 In unsecured mode I want to allow all access to the application.

What User Principal should be used when the application is in
unsecured mode? What should the roles be for that principal?

 I know how to update server.xml and web.xml to achieve both 
 independently, but I am looking for toggle to allow me to control
 the operations mode outside of the application.
 
 Would it work to create a realm which always allows access and
 then configure either a proper authenticating or a less-proper
 allow-all realm in the server.xml file ? Would this still prompt
 users for access ?

Yes, FORM authentication will always ask for credentials if there is
no user principal available.

If you know which user you'd like to use for auto-login, why not
create a Valve that checks for your context parameter and auto-logs-in
the user if you are in unsecured mode? You should be able to use the
HttpServletRequest.login() method to perform the auto-login.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v2
Comment: GPGTools - http://gpgtools.org

iQIcBAEBCAAGBQJVdf7vAAoJEBzwKT+lPKRY1kcQAIqyHg4PbabLj57hJU4ubDme
IEEGee77MVVrJP5eczMNjIT46vvQnz6mcdduCMEetzFFtXRvubm4A7noZwZICNec
A9mMSMVLtVw2QpX92Gf2kPr8t1ECPoII5kgcu4ey0uDqYIvhBuPtmsirK5nZrZ83
0dMVy47/1Lyh77Rf6cIv/GlY9aLNuIMSsTY7Vdx/oqSNRG9lSt1gZAjm6tNCkqOn
3KCZMaSORwfgt2w/LrRXAmxoZKctSYmsPwJ8dJwcU4tGzUko39xdxLy34Q657vTt
nPXYRwkT0eOOPKWNeW/hCKcwAtP23HZzm5yuTC6TcqFxWiKJRt6NvkRa9E094DIf
3qaURHAnXlwE8yDtBXt/aiX5+qAA5Upedd/sWbv/5vnC6O//eo5ZO4pmfjOrBdRT
nSSINBKI7o3NDvi37nXM+K8HHX/xuNKET6liQwEp57pz+seqIumQF5G3CuxmEa+W
DrBduPA3iXPv/nqOHRVm4yb9airKFy8KdarTNRH/GgnuhuzFHBUlqRlS8tU6i4uF
05q1m316uwL9sdiDQmkP5TJ5Hgg7kk+KJHeYiKluJVEU1BjruzlGKKzHMCcrJ6yO
LuiZW5nM1vbHC+SVMY/ZQXdeu/L/twQqAhllOULZGu396jBpQMmXiPYb4m/KkqhF
da1JIXaTzxqGETaRz3h8
=blvG
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: How to upgrade Tomcat

2015-06-08 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Akbar,

On 6/8/15 8:58 AM, Akbar Thanakalacheruvu wrote:
 How to upgrade Tomcat from 7.0.37 to 7.0.62 ? Are there any 
 instructions or document for the same?

I could have sworn there was an Upgrading page on the wiki...

Time to get started.

Briefly:

I. If you are using separate CATALINA_HOME/CATALINA_BASE:

  1. Install Tomcat 7.0.62 to a new directory
  2. Copy your server.xml from the old 7.0.37 conf/ dir to the
 new conf/ dir.
  3. Change CATALINA_HOME to point to your new Tomcat directory
  4. Install any JDBC drivers you may need into your new lib/ dir
  5. Stop/start Tomcat

II. If you are using a combined CATALINA_HOME+CATALINA_BASE

  1. Split your configuration into separate CATALINA_HOME
 and CATALINA_BASE
 (Refer to RUNNING.txt that comes with Tomcat, section Advanced
 for details)
  2. See part (I) above

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v2
Comment: GPGTools - http://gpgtools.org

iQIcBAEBCAAGBQJVdgADAAoJEBzwKT+lPKRYIsUP/iHZfTvaq0yFZmeudtBtVKAS
xGwv4zyCa1ldkJQiTQYiU55AqHwiBzqRtvmgnr8iW6eYVULZQY1Jm3Q0mO2Yw0DK
bIW7fZvEXmtPAjkY/LBy/vC1OlCym1rHS/ALdyX59tyzobM2TBaDfHUdCoNmAHBN
aS2kO6XPPZeGCrcvDPx9jVYpKw1wGqed6HF818g7N3nTXQk1JK14WIuqvjfOUru1
SNYKnXZjL0SXyZEDS5St+Hrw55TJcGixUG4y0khZl/jHudup+zih87a/ZKLGu+eJ
IJJDbu6XynMlPsRS6m1qg5dTtK+O3b0RP/1eyflNug6i9JZdxwWHkUcpPK+Ks+Bz
xyiJ34NCVUd+TCAZgCZk7Y7B1dkmIMpHABL9JpHQkabBc68SloLHdOZDrht5Kr9A
TiB++ytgj0AosFoCJQi5ZXZah2tKRKijpeDPut5ay0F3hnzjkKMdhS2Y8MfR9esA
t4xetbz7cHuWdU6C0JHZJeopP85rdSv4AR5ioVJkiI4Y1Aziim8H97bW4vpSEQBd
CPaSVR7UmO/XMllsv1D9Yxfkc9UG4fR9uUKoPoLs5VoS73Mo1nwAOAk7J/r6pk5v
nwdFakSpyVP58DZZIlX9Vg7N6qJWolYo5B1VPoLlixa2kIr+rEVqpHcv5ZTwP7a6
ayGnwP21jo5/9JvPJLL+
=0W8i
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Vb script not running

2015-06-08 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Ankur,

On 6/8/15 6:32 AM, Ankur Gupta wrote:
 I have apache tomcat  7.0

Which one?

 linux 6.1 server

What is Linux 6.1? My Linux kernels say 2.6.32 or 3.14.42 and I know
I'm not *that* far behind. So, what version number does that actually
refer to?

 I want to deploy a .asp page which contains vb script. The problem
 is that vb script is not executing. Even response.write() is not
 working. Is there any alternative to run vb script?

Is the vb script supposed to run on the server (Tomcat) or the client
(browser)?

If you're expecting this to work on the server, then you may be
confused: Tomcat is a Java application server, and doesn't know a
thing about running VB scripts. If you want the client (browser) to
run the script, then you'd better be running some version of MSIE,
because it's the only browser that supports VB script.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v2
Comment: GPGTools - http://gpgtools.org

iQIcBAEBCAAGBQJVdgDEAAoJEBzwKT+lPKRYMkUP/36Jvjpnqy6hlwv3QKXoZ/FM
ReFPuYoUpQpou6e14Ge3cpMtqCaUV1zae0k0iLBNtq4pWRVZfKjHH+ODWPsKc3SH
EiDYUsEa/R7TBm0u/8TKhgIEPy4q/mmQDx3OI0Zn9pUHma2hxDWFUBRLz8GT1/Ss
0yB3b3julU58f5Wr1W1nWiTonuzfzmM4ikx79eM3rJmzrzhRjpzhVygEU7G3MwP9
Uazxt8eITh4EQdLxCULteM6xoLWWHkqc5eQGdDpCU5jIn8Mv4nNUxZf9llsMuHsN
mYv10YMzKs7su6qHq8rsxLPl/iMDeHeBKCp0L9dDJgBMM53QLtP+52tCodZA9Rhd
j7Z0EH5GYBeGym/lidpYBSgGtRMpAJxVDOVrJxTWUhe7DYIwSNtwsfQn+gwJ6Nto
7SQo2Wb+5H5Grv1J7RCKJL3NBJ/AnzXZktlttDiCZ7v7Lb2/2qZBRRwCeWGg/YC5
oktdUDc1ieIXmlvVQfAQZs9pdRfJu7CW1cEDyPcKjRlWQdYVTV16NZDIqxkXcuCy
M0gkK5F29nnK80J/pc40dm07Vjjrk2pI661jqlXJ0Exik3f+5u8bCiWfLSE8lJJs
6Zhi//1JXIFNl8qKBJAossV247/ksdZPSqwAAIBGGsWX6KMoeKJEbMCfT4Y57bcU
ZjTrYwn6LLBH75d1oOcP
=4mPo
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Tomcat losing request parameters

2015-06-08 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Ravi,

On 6/4/15 10:44 PM, Ravi Kiran wrote:
 All the parameters are lost when this issue occurs.
 
 Code in the filter:
 
 MapString, String[] paramMap = httpRequest.getParameterMap(); 
 StringBuilder sb = new StringBuilder(); if(paramMap != null) { 
 sb.append(System.lineSeparator()); sb.append(Request URI:
 ).append(httpRequest.getRequestURI()); EnumerationString
 headerNames = httpRequest.getHeaderNames(); 
 while(headerNames.hasMoreElements()){ String header =
 headerNames.nextElement(); sb.append(Request Header Name:
 ).append(header); sb.append(, Request Header Value:
 ).append(httpRequest.getHeader(header)); 
 sb.append(System.lineSeparator()); } 
 sb.append(System.lineSeparator()); for(Map.EntryString, String[]
 paramEntry : paramMap.entrySet()) { sb.append(Param Name:
 ).append(paramEntry.getKey()); sb.append(, Param Values:
 ).append(paramEntry.getValue() != null ? 
 Arrays.asList(paramEntry.getValue()) : null); 
 sb.append(System.lineSeparator()); } } LOG.debug(Dumping request
 parameters: {}, sb.toString());

That looks fairly straightforward to me.

Is the servlet expecting to consume the request entity directly (e.g.
a multi-part request, etc.)?

Also, you didn't say whether all of the parameters have been lost or
only some.

To markt's point: are you storing any request-related objects
anywhere, such as a filter's or servlet's members, or in the user's
HttpSession, or even in the request attributes, etc.?

- -chris

 On Thu, Jun 4, 2015 at 9:54 AM, Christopher Schultz  
 ch...@christopherschultz.net wrote:
 
 Ravi,
 
 On 6/4/15 11:40 AM, Ravi Kiran wrote:
 Hi,
 
 I am writing to get some pointers on a strange issue which
 are facing in tomcat in one of our client environments.
 
 Setup: 4 Webservers connecting to 2 tomcat using mod_jk
 (load balanced)
 
 Issue: Request parameters GET/POST are coming as null to the 
 application intermittently i.e, filter in web app dumps the
 request parameters and finds everything empty. TCP dumps are
 inspected and packets are reaching tomcat even during the
 failure cases. Parameters are available in tcpdump but lost
 in between before it reaches application. This happens only
 on one specific client environment which makes it even
 difficult to isolate the problem.
 
 Tomcat Version: 7.0.54
 
 Please suggest some pointers to debug and resolve this issue.
 I can provide more info if needed.
 
 Can we see the code for your Filter?
 
 Do all of the parameters appear to disappear, or only some of
 them?
 
 -chris
 
 -

 
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org
 
 
 
-BEGIN PGP SIGNATURE-
Version: GnuPG v2
Comment: GPGTools - http://gpgtools.org

iQIcBAEBCAAGBQJVdcqXAAoJEBzwKT+lPKRYlBYQAJpZsYAwNFXCM31kZMEUrHr/
yR4QOLJGuEv4FPgteR0YCEJMjmCBQ3Yj8Uq2U0AsYlDAivFuuBcIDWP8DnFWb0xi
TfrcanIwNKfzjblVEuh+HB8/Cf5IjAkBsWNLSa5ntxODooiqkOOikCNPP4l3IPNs
dBGS+XKrlhjDkVUwI2+KmcEkSLHoU0hcGLNYd/K+K1pxGUxYDPUwB2KgV+6iVgQP
X0GaB8BUTChp4GFZAQEkIXz1hz1QYAR2syqTIcYmB/SjrtsSAf5dIKqZhnsaXRKA
Ywl6CVAjvEizvExHOmv6jHIV0EOEqzmWZfWUGTE3qtbpxxSi1O3zXlC6S6p8Odwp
PrTo6KvZG39HWH7R1AZKxfdeDD5IYfXtU21TX2RzLcuUQRI3xLhrrrAGYrb7KPuj
0fLZB4uHQ9f3rQP2Lofl+KN+sja3xLbTbaBpU7+urXfnnXoV1Yfnic4ju3k+xxzN
mgJQOBLFWSR4ZwjkuzDMsuWpokBb0DcA7odJcZCDQibfM3zyR9fZMUCtjayL5UzZ
/d3JiYVe9ZCtq0VlsbqxDo6r9OHuntgSIOE7GQ5ebz8F/E+uP6lZR2Fvw3z5Hg1C
oqPcil3eMNIgV3m+9k7DZP5FFyYHae06Yk1IV6ISwJ+20bmvs37FzCAwW85DJffG
Z7Qf6IjgNfP1SvQRl0KU
=IS6i
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



war exploded: Server is not connected. Deploy is not available.

2015-06-08 Thread Frank Bian
Hi All,
I got the same error : 
http://stackoverflow.com/questions/20163910/tomcat-in-idea-war-exploded-server-is-not-connected-deploy-is-not-available
 
http://stackoverflow.com/questions/20163910/tomcat-in-idea-war-exploded-server-is-not-connected-deploy-is-not-available

__
Connected to the target VM, address: '127.0.0.1:62554', transport: 'socket'
[2015-06-09 10:12:48,226] Artifact com-iyunxiao-dora-web:war exploded: Server 
is not connected. Deploy is not available.
__

My Env : Tomcat 7.0.59 + Inteliij IDEA 14.1 + Mac Pro
And I follow the answer said , but I haven’t found the setEnv.bat/.sh ,the 
catalina.bat/.sh does not contain the settings like this :
set JAVA_OPTS=-server -Xmx768m -XX:MaxPermSize=256M
 I just find below command :
set JAVA_OPTS=%JAVA_OPTS% %LOGGING_CONFIG%”

Any solution to help ?



Best Regards,
Frank Bian





Re: war exploded: Server is not connected. Deploy is not available.

2015-06-08 Thread Frank Bian
I post a question on stackoverflow 
http://stackoverflow.com/questions/30722839/tomcat-in-intellij-idea-14-war-exploded-server-is-not-connected-deploy-is-no
 
http://stackoverflow.com/questions/30722839/tomcat-in-intellij-idea-14-war-exploded-server-is-not-connected-deploy-is-no


Best Regards,
Frank Bian



 On Jun 9, 2015, at 10:41 AM, Frank Bian frankb...@126.com wrote:
 
 Hi All,
 I got the same error : 
 http://stackoverflow.com/questions/20163910/tomcat-in-idea-war-exploded-server-is-not-connected-deploy-is-not-available
  
 http://stackoverflow.com/questions/20163910/tomcat-in-idea-war-exploded-server-is-not-connected-deploy-is-not-available
 
 __
 Connected to the target VM, address: '127.0.0.1:62554', transport: 'socket'
 [2015-06-09 10:12:48,226] Artifact com-iyunxiao-dora-web:war exploded: Server 
 is not connected. Deploy is not available.
 __
 
 My Env : Tomcat 7.0.59 + Inteliij IDEA 14.1 + Mac Pro
 And I follow the answer said , but I haven’t found the setEnv.bat/.sh ,the 
 catalina.bat/.sh does not contain the settings like this :
 set JAVA_OPTS=-server -Xmx768m -XX:MaxPermSize=256M
 I just find below command :
 set JAVA_OPTS=%JAVA_OPTS% %LOGGING_CONFIG%”
 
 Any solution to help ?
 
 
 
 Best Regards,
 Frank Bian
 
 
 



Re: Vb script not running

2015-06-08 Thread André Warnier

Ankur Gupta wrote:

I have apache tomcat  7.0
linux 6.1 server

I want to deploy a .asp page which contains vb script. The problem is that
vb script is not executing. Even response.write() is not working. Is there
any alternative to run vb script?



Assuming that this script should normally be running on the server side..

VB (Visual Basic), as far as I know, is propietary technology of Microsoft 
Corporation.
So without some additional help, it is unlikely to run under anything else than Microsoft 
Operating Systems and/or Microsoft webservers.


This search in Google may point to some answers : apache vbscript linux


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Vb script not running

2015-06-08 Thread Ankur Gupta
I have apache tomcat  7.0
linux 6.1 server

I want to deploy a .asp page which contains vb script. The problem is that
vb script is not executing. Even response.write() is not working. Is there
any alternative to run vb script?


Re: Vb script not running

2015-06-08 Thread Ankur Gupta
Thank you for your reply,
the vb script is normally running under windows server, i had checked it.
When i deploy it into apache tomacat server and try to access vb script
then it does nothing. Is there any alternative method?

On Mon, Jun 8, 2015 at 4:17 PM, André Warnier a...@ice-sa.com wrote:

 Ankur Gupta wrote:

 I have apache tomcat  7.0
 linux 6.1 server

 I want to deploy a .asp page which contains vb script. The problem is that
 vb script is not executing. Even response.write() is not working. Is there
 any alternative to run vb script?


 Assuming that this script should normally be running on the server side..

 VB (Visual Basic), as far as I know, is propietary technology of Microsoft
 Corporation.
 So without some additional help, it is unlikely to run under anything else
 than Microsoft Operating Systems and/or Microsoft webservers.

 This search in Google may point to some answers : apache vbscript linux


 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org




Re: Vb script not running

2015-06-08 Thread André Warnier

Hi.

1) on this list, it is highly-recommended to not top post

Ankur Gupta wrote:

Thank you for your reply,
the vb script is normally running under windows server, i had checked it.
When i deploy it into apache tomacat server and try to access vb script
then it does nothing. Is there any alternative method?


2) did you even look at the list to which I pointed you in Google ?

Here are 2 more pages which may help you understand the issue better :

http://modvb.sourceforge.net/FAQ.shtml
http://www.mono-project.com/

Please read them before coming back with another question.

Here is some additional, but very summary information :

Tomcat is a Java Servlet Engine (or Container). It can run so-called dynamic pages, 
using a technology known as JSP (Java Server Pages).  As the name indicates, the code in 
those pages is supposed to be Java.


Pages containing vbscript sections are usually part of another technology, known as ASP, 
which is Microsoft-specific.  Tomcat will not run that, it doesn't even know what it is.


The links above point to solutions which could allow you to run such pages under Apache 
httpd (under Linux or Windows), which is another webserver than Tomcat, but which could be 
used as a front-end to Tomcat, to run these things.


If your problem is only a few vbscript sections, then you may want to consider rewriting 
these parts of the application in Java/JSP.  The benefit would be that then, they would 
become cross-platform (for Linux and Windows).
If there is a lot of vbscript used in the application, and you do not want to convert it 
to Java, then look at the solutions indicated above.





On Mon, Jun 8, 2015 at 4:17 PM, André Warnier a...@ice-sa.com wrote:


Ankur Gupta wrote:


I have apache tomcat  7.0
linux 6.1 server

I want to deploy a .asp page which contains vb script. The problem is that
vb script is not executing. Even response.write() is not working. Is there
any alternative to run vb script?



Assuming that this script should normally be running on the server side..

VB (Visual Basic), as far as I know, is propietary technology of Microsoft
Corporation.
So without some additional help, it is unlikely to run under anything else
than Microsoft Operating Systems and/or Microsoft webservers.

This search in Google may point to some answers : apache vbscript linux


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org







-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Question concerning mod_jk Security Fix CVE-2014-8111

2015-06-08 Thread Pascal Wittmann
Hi Peter,

I've asked the same question on 31.05 but got no reply so far. Thanks
for the RedHat link.

Regards,
Pascal


On 06/08/2015 01:43 PM, Kreuser, Peter wrote:
 Hi,
 
 could you please tell us, when the fixed mod_jk-Version 1.2.41 will be 
 publicly available?
 
 The webpage does not mention any vulnerability at all, plus no newer release 
 than the vulnerable 1.2.40.
 
 For now RedHat mentions only the fix to the source code from December 2014.
 http://svn.apache.org/viewvc?view=revisionrevision=1647017
 
 Best regards.
 
 Peter
 
 




signature.asc
Description: OpenPGP digital signature


Re: How to upgrade Tomcat

2015-06-08 Thread David kerber

On 6/8/2015 8:58 AM, Akbar Thanakalacheruvu wrote:

Hi

How to upgrade Tomcat from 7.0.37 to 7.0.62 ? Are there any instructions or 
document for the same?


If you are using a standard installation from the ASF, then just install 
the newer version over the old one and test your app.





Thanks for the help in advance.

-Akbar

This message and any attachments thereto contain information that may be privileged, 
confidential or otherwise protected from disclosure and is the property of SumTotal 
Systems, LLC  It is intended only for the person to whom it is addressed.  If you are 
not the intended recipient, you are not authorized to read, print, retain, copy, 
disseminate, distribute, or use this message, any attachments thereto or any part 
thereof.  If you receive this message in error, please notify me at 
akb...@sumtotalsystems.commailto:akb...@sumtotalsystems.com and delete all 
copies of this message and attachments.   SumTotal Systems, LLC has implemented 
anti-virus software on its computers and servers, however, it is the recipient's own 
responsibility to ensure that all attachments are scanned for viruses prior to usage.




-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



I changed the context.xml for manager and now manager will not start

2015-06-08 Thread Mark Shifman

Help I feel like such a ninny:

I am using apache-tomcat-8.0.20 java version 1.8.0_25  on a linux box.
my new context.xml is (I changed some datasource parameters) and is living in 
manager

Context antiResourceLocking=false privileged=true 
  Resource name=jdbc/prot_manager auth=Container
type=javax.sql.DataSource 
driverClassName=oracle.jdbc.driver.OracleDriver
url=jdbc:oracle:thin:xxx.xxx.xxx.xxx:1521:xxx
username=xxx
password=xxx
maxTotal=2
maxIdle=2
maxWaitMillis=1
testOnCreate=true
testOnBorrow=true
timeBetweenEvictionRunsMillis=1
removeAbandonedTimeout=300
removeAbandonedOnBorrow=true
testWhileIdle=true
closeMethod=close
connectionInitSqls=call dbms_session.set_identifier('manager')/

  Realm className=org.apache.catalina.realm.LockOutRealm
  Realm className=org.apache.catalina.realm.DataSourceRealm
  dataSourceName=jdbc/prot_manager localDataSource=true
  userTable=p_user userNameCol=logon_id userCredCol=password
  userRoleTable=p_user_roles roleNameCol=role_name /
/Realm
  Valve className=org.apache.catalina.valves.RemoteAddrValve 
allow=xxx\.xx\.xx\.xxx|xxx\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1 /
/Context

the old one that worked was
Context antiResourceLocking=false privileged=true 
  Resource name=jdbc/prot_manager auth=Container
type=javax.sql.DataSource 
driverClassName=oracle.jdbc.driver.OracleDriver
url=jdbc:oracle:thin:.xxx.xxx.xxx:1521:
username=
password=
maxTotal=2
maxIdle=2
maxWait=1
validationQuery=SELECT 1 from dual
testOnBorrow=true
closeMethod=close
connectionInitSqls=call dbms_session.set_identifier('manager')/

  Realm className=org.apache.catalina.realm.LockOutRealm
  Realm className=org.apache.catalina.realm.DataSourceRealm
  dataSourceName=jdbc/prot_manager localDataSource=true
  userTable=p_user userNameCol=logon_id userCredCol=password
  userRoleTable=p_user_roles roleNameCol=role_name /
/Realm
  Valve className=org.apache.catalina.valves.RemoteAddrValve 
allow=xxx\.xx\.xx\.xx|xx\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1 /
/Context

I even tried the virginal context.xml

Context antiResourceLocking=false privileged=true 
  !--
Remove the comment markers from around the Valve below to limit access to
the manager application to clients connecting from localhost
  --
  !--
  Valve className=org.apache.catalina.valves.RemoteAddrValve
 allow=127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1 /
  --
/Context

each time restarting tomcat with no luck in starting the manager.

I don't see anything in my logs but maybe there is some log somewhere I haven't 
found like in /var/logs.

any help would be appreciated.

--
Mark Shifman MD. Ph.D.
Yale Center for Medical Informatics
Phone (203)737-5219
mark.shif...@yale.edu


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



How to upgrade Tomcat

2015-06-08 Thread Akbar Thanakalacheruvu
Hi

How to upgrade Tomcat from 7.0.37 to 7.0.62 ? Are there any instructions or 
document for the same?

Thanks for the help in advance.

-Akbar

This message and any attachments thereto contain information that may be 
privileged, confidential or otherwise protected from disclosure and is the 
property of SumTotal Systems, LLC  It is intended only for the person to whom 
it is addressed.  If you are not the intended recipient, you are not authorized 
to read, print, retain, copy, disseminate, distribute, or use this message, any 
attachments thereto or any part thereof.  If you receive this message in error, 
please notify me at 
akb...@sumtotalsystems.commailto:akb...@sumtotalsystems.com and delete all 
copies of this message and attachments.   SumTotal Systems, LLC has implemented 
anti-virus software on its computers and servers, however, it is the 
recipient's own responsibility to ensure that all attachments are scanned for 
viruses prior to usage.


Re: How to upgrade Tomcat

2015-06-08 Thread Neill Lima
I love this page: http://tomcat.apache.org/migration-7.html#Upgrading_7.0.x

Result:

http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/conf/catalina.policy?diff_format=hr1=1445362r2=1678231

On Mon, Jun 8, 2015 at 3:00 PM, David kerber dcker...@verizon.net wrote:

 On 6/8/2015 8:58 AM, Akbar Thanakalacheruvu wrote:

 Hi

 How to upgrade Tomcat from 7.0.37 to 7.0.62 ? Are there any instructions
 or document for the same?


 If you are using a standard installation from the ASF, then just install
 the newer version over the old one and test your app.



 Thanks for the help in advance.

 -Akbar

 This message and any attachments thereto contain information that may be
 privileged, confidential or otherwise protected from disclosure and is the
 property of SumTotal Systems, LLC  It is intended only for the person to
 whom it is addressed.  If you are not the intended recipient, you are not
 authorized to read, print, retain, copy, disseminate, distribute, or use
 this message, any attachments thereto or any part thereof.  If you receive
 this message in error, please notify me at akb...@sumtotalsystems.com
 mailto:akb...@sumtotalsystems.com and delete all copies of this
 message and attachments.   SumTotal Systems, LLC has implemented anti-virus
 software on its computers and servers, however, it is the recipient's own
 responsibility to ensure that all attachments are scanned for viruses prior
 to usage.



 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org




Question concerning mod_jk Security Fix CVE-2014-8111

2015-06-08 Thread Kreuser, Peter
Hi,

could you please tell us, when the fixed mod_jk-Version 1.2.41 will be publicly 
available?

The webpage does not mention any vulnerability at all, plus no newer release 
than the vulnerable 1.2.40.

For now RedHat mentions only the fix to the source code from December 2014.
http://svn.apache.org/viewvc?view=revisionrevision=1647017

Best regards.

Peter