Re: How to disable default servlet?

2007-01-09 Thread Mikolaj Rydzewski
Narayanaswamy, Mohan wrote: We use shared Apache+Tomcat, We need apache to serve static and tomcat for dynamic, By no way tomcat should provide static resources. Sounds like security-by-obscurity. Either configure apache properly and tomcat will not get any requests for static resources -

Re: Web Statistics in Tomcat 5.5

2007-01-09 Thread Mikolaj Rydzewski
Chetan Pandey wrote: I just want to know if there is any Free and Open Source Software for Tomcat 5.5 which will generate all the Web Statistics related to User Interaction with our Web-site. Preferably without requiring installation of Apache httpd. Enable apache-style access logging

Re: something wrong creating datasource after war deployement

2007-01-09 Thread Arnaud MERGEY
thnaks for all, it's clear for me now. Caldarale, Charles R a écrit : From: Arnaud MERGEY [mailto:[EMAIL PROTECTED] Subject: Re: something wrong creating datasource after war deployement I updated the META-INF/context.xml in the unpacked directory, You need to update the one in

Embedding an integration engine in Tomcat

2007-01-09 Thread andy.mcneill
Hello, I'm looking to deploy a very lightweight integration engine into Tomcat. What I need it to do is -Receive messages over http, ftp, web service, jms Or -Retrieve messages from an Oracle database -Transform messages to a proprietary XML format -Send transformed messages out over http

Securing Tomcat Article for Review

2007-01-09 Thread Darren
I've been working on an article about securing tomcat for the Open Web Application Security Project (OWASP). The article details some quick and easy ways to improve the 'out of the box' security of tomcat from the perspective of a sysadmin. It's written with tomcat 5.5 in mind, but

Re: Securing Tomcat Article for Review

2007-01-09 Thread Leon Rosenberg
Who's the target audience? Things like: Change files in CATALINA_HOME/conf to be readonly (400) ... Rename CATALINA_HOME/conf/server.xml to CATALINA_HOME/conf/server-original.xml and rename CATALINA_HOME/conf/server-minimal.xml to CATALINA_HOME/conf/server.xml. The minimal configuration provides

Embedding an integration engine in Tomcat

2007-01-09 Thread andy.mcneill
Hello, I'm looking to deploy a very lightweight integration engine into Tomcat. What I need it to do is -Receive messages over http, ftp, web service, jms Or -Retrieve messages from an Oracle database -Transform messages to a proprietary XML format -Send transformed messages out over http

tomcat 5.5, java 6 and jconsole not working as service

2007-01-09 Thread teknokrat
I am running Tomcat 5.5 as a service using Java 6. I try to connect jconsole locally but it can't seem to find tomcat. Anyone know how I can do this? thanks - To start a new topic, e-mail: users@tomcat.apache.org To

Can APR use verisign certs ?

2007-01-09 Thread robert lazarski
Hi all, I'm using apr 1.1.3 with tomcat 5.5.18 and openssl . During my research I noticed that self-signed certs seem to work , but I'm in doubt if pay type $$$ certs from verisign will work. We've submitted our csr to verisign , and if I understand correctly we need to use the crt from versign

Cannot create object of class

2007-01-09 Thread Stephan Schöffel
hi, have a problem with creating a class in the doPost method of a servlet: MyClass mc= new MyClass(); if i do so i get the following error message: HTTP Status 500 - *type* Exception report *message* *description*

Re: Cannot create object of class

2007-01-09 Thread Li
Hi, it seems that catalina was trying to find your MyClass in her manager's classpath java.lang.NoClassDefFoundError: org/apache/catalina/manager/MyClass$1. Make sure your class path is correct. A faster way to test if to write a simple jsp and run your thread inside % ... %. You can need

Re: Cannot create object of class

2007-01-09 Thread Stephan Schöffel
MyClass is in the manage lib. if i delete this timer-stuff it works fine... but i need the timer Li wrote: Hi, it seems that catalina was trying to find your MyClass in her manager's classpath java.lang.NoClassDefFoundError: org/apache/catalina/manager/MyClass$1. Make sure your class path

Re: Cannot create object of class

2007-01-09 Thread Li
try to call your time in a single jsp file. say test.jsp ... %@ page import=yourtimerpath % % ... I am calling my timer here % See if you can make it work ... On 1/9/07, Stephan Schöffel [EMAIL PROTECTED] wrote: MyClass is in the manage lib. if i delete this timer-stuff it works

Re: Can APR use verisign certs ?

2007-01-09 Thread Mladen Turk
robert lazarski wrote: Hi all, I'm using apr 1.1.3 with tomcat 5.5.18 and openssl . During my research I noticed that self-signed certs seem to work , but I'm in doubt if pay type $$$ certs from verisign will work. We've submitted our csr to verisign , and if I understand correctly we need to

Re: Tomcat5.5 webserver unstable

2007-01-09 Thread Roland Lammel
This looks more like your application(s) is keeping the threads busy. So tomcat is running out of free threads/workers to handle the incoming requests. You are either having a generic problem in your application where your application is not closing the request hence keeping the thread occupied,

Re: web application - student need help Thank You's

2007-01-09 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mike, Michael Ni wrote: So during login, after a person enters his username and password, it will check to see if the username exists in the person table. If it does exist, it will verify the password and return his permission. That

Using the balancer app to redirect. Well, trying to

2007-01-09 Thread Jeremy
Hi Sorry if this is a bit of a dumb question, but I just wondered if anyone had any handy hints for the problem below: I'm trying to set up a tomcat 5.0.28 instance (on Debian) to achieve redirecting accesses to site1.company.com through to newsite1.org, using the balancer app. rather than

RE: Tomcat5.5 webserver unstable

2007-01-09 Thread Caldarale, Charles R
From: mocherla14 [mailto:[EMAIL PROTECTED] Subject: Tomcat5.5 webserver unstable Dec 5, 2006 11:33:07 AM org.apache.tomcat.util.threads.ThreadPool logFull SEVERE: All threads (200) are currently busy, waiting. Take a thread dump of the situation and find out where the threads are

Re: tomcat 5.5, java 6 and jconsole not working as service

2007-01-09 Thread Martin Dubuc
I haven't been successful running Tomcat on Java 6. My guess is that Tomcat can't run yet on Java 6. Martin On 1/9/07, teknokrat [EMAIL PROTECTED] wrote: I am running Tomcat 5.5 as a service using Java 6. I try to connect jconsole locally but it can't seem to find tomcat. Anyone know how I can

Re: Securing Tomcat Article for Review

2007-01-09 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Leon, Leon Rosenberg wrote: Also by using apache in front of tomcat you rather loose[sic] security than gain it. At least this is my personal opinion :-) Would you care to defend that argument? Security in layers is typically an advantage. One

Re: tomcat 5.5, java 6 and jconsole not working as service

2007-01-09 Thread Jess Holle
Tomcat 5.5.20 runs fine with Java 6, though I'm not sure if I tried it as a service. Martin Dubuc wrote: I haven't been successful running Tomcat on Java 6. My guess is that Tomcat can't run yet on Java 6. Martin On 1/9/07, teknokrat [EMAIL PROTECTED] wrote: I am running Tomcat 5.5 as a

RE: tomcat 5.5, java 6 and jconsole not working as service

2007-01-09 Thread Caldarale, Charles R
From: Martin Dubuc [mailto:[EMAIL PROTECTED] Subject: Re: tomcat 5.5, java 6 and jconsole not working as service I haven't been successful running Tomcat on Java 6. My guess is that Tomcat can't run yet on Java 6. 5.5.20 runs fine for me with JDK 6 on XP, both as a service and from the

Re: tomcat 5.5, java 6 and jconsole not working as service

2007-01-09 Thread David Smith
I've had some interesting issues with Maven 2 and Java 6, but Tomcat 5.5.20 has run great on Java 6. --David Martin Dubuc wrote: I haven't been successful running Tomcat on Java 6. My guess is that Tomcat can't run yet on Java 6. Martin On 1/9/07, teknokrat [EMAIL PROTECTED] wrote: I am

Re: Securing Tomcat Article for Review

2007-01-09 Thread Andrew Miehs
On 09/01/2007, at 5:20 PM, Christopher Schultz wrote: Leon Rosenberg wrote: Also by using apache in front of tomcat you rather loose[sic] security than gain it. At least this is my personal opinion :-) Would you care to defend that argument? Security in layers is typically an advantage.

RE: Securing Tomcat Article for Review

2007-01-09 Thread Peter Crowther
From: Christopher Schultz [mailto:[EMAIL PROTECTED] I would argue that Apache httpd is quite mature and is trustworthy. Sure, you're not likely to run into a buffer overflow bug in Tomcat, but a bad configuration can open any server to attack. Is a bad Tomcat configuration alone any better

do i need to build form source if i want install tomcat on 64-bit linux machine

2007-01-09 Thread vamsee movva
Hello all, I would like to install tomcat on 64-bit linux machine. do i need to build it from source or can i directly take the binary files provided in the website. Is there any difference between building it from source and directly taking binaries which are i guess compiled on 32-bit machines.

Re: Using the balancer app to redirect. Well, trying to

2007-01-09 Thread Hassan Schroeder
On 1/9/07, Jeremy [EMAIL PROTECTED] wrote: I'm trying to set up a tomcat 5.0.28 instance (on Debian) to achieve redirecting accesses to site1.company.com through to newsite1.org, using the balancer app. rather than apache webserver and the AJP connectors. The easiest solution would of course

RE: Running Tomcat5.5 as 64 bit application

2007-01-09 Thread Nelson, Tracy M.
| From: Jonas Fagerstrom [mailto:[EMAIL PROTECTED] | Sent: Monday, 08 January, 2007 20:17 | | Mladen Turk mladen.turk at jboss.com writes: | | Use 64 bit procrun (tomcat5.exe) from: | http://svn.apache.org/viewvc/tomcat/connectors/trunk/procrun/bin/ | (remove the .amd64 extension of course) |

RE: do i need to build form source if i want install tomcat on 64-bit linux machine

2007-01-09 Thread Peter Crowther
From: vamsee movva [mailto:[EMAIL PROTECTED] Hello all, I would like to install tomcat on 64-bit linux machine. do i need to build it from source or can i directly take the binary files provided in the website. You can take the binary files if you want to run the system as a pure Java

Re: do i need to build form source if i want install tomcat on 64-bit linux machine

2007-01-09 Thread vamsee movva
Thank you very much , Peter. I used to install each and everything from source, by assuming we should do that. I wasted lot of time in that. Thaks again peter. cheers vamsee movva On 1/9/07, Peter Crowther [EMAIL PROTECTED] wrote: From: vamsee movva [mailto:[EMAIL PROTECTED] Hello all, I

Tomcat and JSTL 1.2

2007-01-09 Thread ben short
Hi all, Im trying to use jstl 1.2 with tomcat 5.5.20 and java 1.5.0_05-b05. My webapp deploys ok but when I browse to it I get the following exception. xception org.apache.jasper.JasperException: Unable to read TLD META-INF/c.tld from JAR file

Re: Can APR use verisign certs ?

2007-01-09 Thread robert lazarski
On 1/9/07, Mladen Turk [EMAIL PROTECTED] wrote: robert lazarski wrote: Hi all, I'm using apr 1.1.3 with tomcat 5.5.18 and openssl . During my research I noticed that self-signed certs seem to work , but I'm in doubt if pay type $$$ certs from verisign will work. We've submitted our csr to

RE: tomcat 5.5, java 6 and jconsole not working as service

2007-01-09 Thread Caldarale, Charles R
From: news [mailto:[EMAIL PROTECTED] On Behalf Of teknokrat Subject: tomcat 5.5, java 6 and jconsole not working as service I am running Tomcat 5.5 as a service using Java 6. I try to connect jconsole locally but it can't seem to find tomcat. By default, JConsole only connects to local

Getting Tomcat5.exe to run with server JVM

2007-01-09 Thread Sascha Wehnert
Hi, I’m quite new to the whole JAVA stuff so it might happen, that I do not use the right terms ;-) I need to get a Tomcat 5.5.20 to run with -server. It was installed using the available exe-installation file. I found already a previous thread about this topic located at

Re: Securing Tomcat Article for Review

2007-01-09 Thread Markus Schönhaber
Christopher Schultz wrote: Leon Rosenberg wrote: Also by using apache in front of tomcat you rather loose[sic] security than gain it. At least this is my personal opinion :-) Would you care to defend that argument? You defend it yourself in the next paragraph you've written. One could

RE: Java memory profiler

2007-01-09 Thread Nelson, Tracy M.
| From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] | lucent.com.au] | Sent: Monday, 08 January, 2007 20:22 | | I would like to profile a Tomcat application on Solaris machine. | [snip] | I would appreciate any suggestions. I can't say enough good things about JProbe (www.quest.com/jprobe). I

RE: Tomcat and JSTL 1.2

2007-01-09 Thread Derrick Koes
%@ taglib prefix=c uri=http://java.sun.com/jsp/jstl/core; % c:redirect url=/show.html/ Perhaps a missing quote in the url attribute? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of ben short Sent: Tuesday, January 09, 2007 12:08 PM To: Tomcat Users List

Re: Tomcat and JSTL 1.2

2007-01-09 Thread ben short
Derrick, Thanks for spoting that, but thats a typo when i typed it into the email On 1/9/07, Derrick Koes [EMAIL PROTECTED] wrote: %@ taglib prefix=c uri=http://java.sun.com/jsp/jstl/core; % c:redirect url=/show.html/ Perhaps a missing quote in the url attribute? -Original Message-

JNDI example for connecting to a DB2 on OS400

2007-01-09 Thread Greg Foulks
I've read the JNDI docs and can't find an example as to how to configure a connection for a DB2. I need to be able to setup a autoreconnect and a validation query in my server.xml but can't seem to find an example. Anyone able to help direct me in the to right location? Greg

RE: Getting Tomcat5.exe to run with server JVM

2007-01-09 Thread Caldarale, Charles R
From: Sascha Wehnert [mailto:[EMAIL PROTECTED] Subject: Getting Tomcat5.exe to run with server JVM If I add -server to JAVA Options within the tomcat monitor or tomcat5w.exe and try to restart stdout log file reports unrecognized option -server. The -server option is only recognized by

RE: Can APR use verisign certs ?

2007-01-09 Thread Peter Crowther
From: robert lazarski [mailto:[EMAIL PROTECTED] However, on the client side I'm getting a There's a problem with the sites security certificate. That's in IE6 , on firefox I get a similair popup . We have registered the csr with verisign. Is this solely a client side and verisign issue. Any

Re: APR not picking up tcnative-1.dll

2007-01-09 Thread robert lazarski
On 1/8/07, robert lazarski [EMAIL PROTECTED] wrote: On 1/8/07, Caldarale, Charles R [EMAIL PROTECTED] wrote: From: robert lazarski [mailto:[EMAIL PROTECTED] Subject: Re: APR not picking up tcnative-1.dll 2) Are you using a 64-bit JVM on the Windows box? Nope! We are using the 32bit

Re: Can APR use verisign certs ?

2007-01-09 Thread robert lazarski
On 1/9/07, Peter Crowther [EMAIL PROTECTED] wrote: From: robert lazarski [mailto:[EMAIL PROTECTED] However, on the client side I'm getting a There's a problem with the sites security certificate. That's in IE6 , on firefox I get a similair popup . We have registered the csr with verisign.

Re: Can APR use verisign certs ?

2007-01-09 Thread robert lazarski
On 1/9/07, robert lazarski [EMAIL PROTECTED] wrote: On 1/9/07, Peter Crowther [EMAIL PROTECTED] wrote: From: robert lazarski [mailto:[EMAIL PROTECTED] However, on the client side I'm getting a There's a problem with the sites security certificate. That's in IE6 , on firefox I get a

RE: Can APR use verisign certs ?

2007-01-09 Thread Peter Crowther
From: robert lazarski [mailto:[EMAIL PROTECTED] It says: 1) Cert is from a valid authority (good) OK. 2) The ceritificate has expired or is not yet valid OK. Get the certificate details (which you can do within IE6); you can see the issue date and expiry date. My guess is that it may

RE: Can APR use verisign certs ?

2007-01-09 Thread Peter Crowther
From: robert lazarski [mailto:[EMAIL PROTECTED] Any clues before asking verisign ? Can you tell us (or me privately) the address of the site if it's Internet-accessible? I can then connect and have a look at the cert and the surrounding environment. If we can see the problem, we'll be able

Re: Tomcat and JSTL 1.2

2007-01-09 Thread Tim Funk
Looks like you are missing the JSTL jar files whihc need to be in WEB-INF/lib -Tim ben short wrote: Hi all, Im trying to use jstl 1.2 with tomcat 5.5.20 and java 1.5.0_05-b05. My webapp deploys ok but when I browse to it I get the following exception. xception

Re: Can APR use verisign certs ?

2007-01-09 Thread robert lazarski
On 1/9/07, Peter Crowther [EMAIL PROTECTED] wrote: From: robert lazarski [mailto:[EMAIL PROTECTED] Any clues before asking verisign ? Can you tell us (or me privately) the address of the site if it's Internet-accessible? I can then connect and have a look at the cert and the surrounding

Re: Tomcat and JSTL 1.2

2007-01-09 Thread ben short
Tim, Thats what I thought, but I check and double checked and the jstl-1.2.jar file is in the correct location. It also has the c.tld inside it. On 1/9/07, Tim Funk [EMAIL PROTECTED] wrote: Looks like you are missing the JSTL jar files whihc need to be in WEB-INF/lib -Tim ben short wrote:

RE: Cannot create object of class

2007-01-09 Thread Caldarale, Charles R
From: Stephan Schöffel [mailto:[EMAIL PROTECTED] Subject: Cannot create object of class java.lang.NoClassDefFoundError: org/apache/catalina/manager/MyClass$1 It's not MyClass that can't be found, it's a failure to create the anonymous inner class: timer.schedule(new TimerTask(){

Re: Securing Tomcat Article for Review

2007-01-09 Thread Gregor Schneider
well, putting up apache in front of tomcat usually is not done due to security-reasons. however, doing so won't do any harm if you know what you're doing... ;) the only reason putting up apache in front usually is to serve static content when running a high-load-web-app. besides, you can do

RE: Can APR use verisign certs ?

2007-01-09 Thread Peter Crowther
From: robert lazarski [mailto:[EMAIL PROTECTED] http://alpha-web01.alphatheory.com/atdev/ The cert's issued to dpt.alphatheory.com; you're testing connections to alpha-web01.alphatheory.com. Any sensible browser will scream at that difference. If they didn't, crackers would be able to get a

RE: Tomcat and JSTL 1.2

2007-01-09 Thread Derrick Koes
The .tld file itself should tell you the URL you need in the directive to access the file. The .tld file doesn't need to be in web-inf/lib. These can be accessed from the jar, at least that was true with JSTL 1.1. I would check the .tld, perhaps the uri element value changed. Example: .tld

Is Tomcat still the reference implementation for Servlets and JSP?

2007-01-09 Thread Jon Miller
Hi all, Does anyone know if Tomcat is still the reference implementation for Servlets and JSP? I thought the Servlets 2.5 spec was finalized in May. Why is it taking so long for a release version of Tomcat that implements Servlets 2.5? Also, I don't understand how Glassfish can support the

Re: Can APR use verisign certs ?

2007-01-09 Thread robert lazarski
On 1/9/07, Peter Crowther [EMAIL PROTECTED] wrote: From: robert lazarski [mailto:[EMAIL PROTECTED] http://alpha-web01.alphatheory.com/atdev/ The cert's issued to dpt.alphatheory.com; you're testing connections to alpha-web01.alphatheory.com. Any sensible browser will scream at that

Creating a custom session manager

2007-01-09 Thread Bryan Basham
Hello Tomcat users, I have a need that I believe Tomcat's pluggable session manager facility can satisfy, but I am having trouble getting it configured. BTW, I have googled and searched the mail archives on this topic and have not found anything useful yet. My application requires a modular

Re: Is Tomcat still the reference implementation for Servlets and JSP?

2007-01-09 Thread Tim Funk
Tomcat isn't used in the RI for 2.5. Glassfish is a fork of tomcat. So you'll notice many things the same. -Tim Jon Miller wrote: Hi all, Does anyone know if Tomcat is still the reference implementation for Servlets and JSP? I thought the Servlets 2.5 spec was finalized in May. Why is it

Re: Can APR use verisign certs ?

2007-01-09 Thread Mladen Turk
robert lazarski wrote: On 1/9/07, Peter Crowther [EMAIL PROTECTED] wrote: From: robert lazarski [mailto:[EMAIL PROTECTED] Any clues before asking verisign ? Can you tell us (or me privately) the address of the site if it's Internet-accessible? I can then connect and have a look at the cert

Re: Securing Tomcat Article for Review

2007-01-09 Thread Darren
Things like: Change files in CATALINA_HOME/conf to be readonly (400) ... Rename CATALINA_HOME/conf/server.xml to ... won't work for dummies (due to missing rights) if they'll follow the guide step by step. You're right, the ordering is perhaps a little confusing. The article is not aimed

Re: Is Tomcat still the reference implementation for Servlets and JSP?

2007-01-09 Thread Bob Hall
With regard to Servlet spec 2.5 see: http://tomcat.apache.org/tomcat-6.0-doc/index.html -Bob --- Tim Funk [EMAIL PROTECTED] wrote: Tomcat isn't used in the RI for 2.5. Glassfish is a fork of tomcat. So you'll notice many things the same. -Tim Jon Miller wrote: Hi all, Does

Re: Securing Tomcat Article for Review

2007-01-09 Thread Markus Schönhaber
Did you read the article that is subject to this thread? Gregor Schneider wrote: putting up apache in front of tomcat usually is not done due to security-reasons. however, doing so won't do any harm if you know what you're doing... ;) Whatever you're doing, it's always a good idea to know

RE: Creating a custom session manager

2007-01-09 Thread Caldarale, Charles R
From: Bryan Basham [mailto:[EMAIL PROTECTED] Subject: Creating a custom session manager I am trying to use the DefaultContext tag to setup the manager on all webapps. Assuming you're using a current (5.5 or better) level of Tomcat, I don't believe the DefaultContext tag is used anymore

Re: Securing Tomcat Article for Review

2007-01-09 Thread Gregor Schneider
Hi Markus, On 1/9/07, Markus Schönhaber [EMAIL PROTECTED] wrote: Did you read the article that is subject to this thread? yep I don't think I understand how your post relates to mine. My post relates to yours and to some other posts here in that sense that you (and others) stated that

Problem with auto-deploy

2007-01-09 Thread David Rush
I'm having trouble with the auto-deploy of .war files on Tomcat 5.5.20 running on Windows 2003 Server. When I drop a new .war file into the appropriate webapps directory, Tomcat's finding it and trying to deploy it, but it fails. It succeeds in removing the old directory (that a previous

RE: Securing Tomcat Article for Review

2007-01-09 Thread Caldarale, Charles R
From: Gregor Schneider [mailto:[EMAIL PROTECTED] Subject: Re: Securing Tomcat Article for Review OTOH, i'd rather have apache in front than running tomcat on port 80 via jsvc or as a service. Why? - Chuck THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY

RE: Problem with auto-deploy

2007-01-09 Thread Caldarale, Charles R
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Subject: Problem with auto-deploy 2007-01-09 11:21:44,859 (org.apache.catalina.startup.ContextConfig,init(),ERROR) Exception fixing docBase: {0} java.util.zip.ZipException: The process cannot access the file because it is being used by

Help with Tomcat 5.5 mod_jk 1.2.20 loadbalancing sticky session issue

2007-01-09 Thread Carlos Campos
Hi, I have installed one instance of apache 2.2.3 with mod_jk 1.2.20, two instances of tomcat 5.5, and Java 1.5.0 I m trying to set up a loadbalancer that supports sticky sessions. However what I m getting when i access the test.jsp via (http://somedomain.com/carlos.jsp) round robin hits on

Re: Securing Tomcat Article for Review

2007-01-09 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Andrew, Andrew Miehs wrote: With Apache HTTPD you have the advantage of being able to do fine grained url/ IP access control. I believe that Tomcat also has that capability. Am I wrong? - -chris -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.6

Re: Securing Tomcat Article for Review

2007-01-09 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Markus, Markus Schönhaber wrote: You defend it yourself in the next paragraph you've written. One could argue that more moving parts equals more complexity, and that complexity is an enemy of security (and I agree). However, there must be a

Re: Securing Tomcat Article for Review

2007-01-09 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Darren, Darren wrote: I think the 'running on port 80' section needs some rewording as I'm not advocating that putting IIS or apache infront of your tomcat installation will make it any more secure. As a sysadmin you may be asked to serve tomcat

Best way to include common html

2007-01-09 Thread Scott Cowley
What is the best approach to get shared HTML files, (such as header and footer files) located outside each appBase, included into an application (.jsp) under Tomcat? SSI filter ? Or some context resource setting ? Thanks for any help. - s.c., university of utah

RE: Best way to include common html

2007-01-09 Thread Scott Purcell
Possibly a framework for templating. Tiles, SiteMesh they are created for exactly what you are looking for. Of course you can use JSP includes ... but the frameworks do a better job IMOHO. -Original Message- From: Scott Cowley [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 09, 2007

RE: downloading JSTL..

2007-01-09 Thread Propes, Barry L [GCG-NAOT]
so would I just dump all of the .tld files in my WEB-INF sub directory titled tlds? For instance, I've got a directory in my webapps folder, then a WEB-INF directory for it, then inside it I've got a directory titled tlds. Just throw them in there? -Original Message- From: Wendy Smoak

Re: Can APR use verisign certs ?

2007-01-09 Thread robert lazarski
On 1/9/07, Peter Crowther [EMAIL PROTECTED] wrote: From: robert lazarski [mailto:[EMAIL PROTECTED] http://alpha-web01.alphatheory.com/atdev/ The cert's issued to dpt.alphatheory.com; you're testing connections to alpha-web01.alphatheory.com. Any sensible browser will scream at that

Re: Help with Tomcat 5.5 mod_jk 1.2.20 loadbalancing sticky session issue

2007-01-09 Thread Rainer Jung
This one is easy: you've got a twist in the routing config: mod_jk: jvm1=port 18007, jvm2=port 18009 Tomcat: jvm1=port 18009, jvm1=port 18007 Hope this helps, have fun with mod_jk :) Rainer Carlos Campos schrieb: Hi, I have installed one instance of apache 2.2.3 with mod_jk 1.2.20, two

Re: Complex Tomcat and IIS configuration

2007-01-09 Thread Rainer Jung
No config, no log: no idea :( Tor Langehaug schrieb: I am running a web server with about 10 different virtually hosted sites. Tomcat is installed and functioning with http://localhost:8084/ (the default port of tomcat is used by another application), however I cannot access tomcat by this

Re: Securing Tomcat Article for Review

2007-01-09 Thread Leon Rosenberg
On 1/9/07, Christopher Schultz [EMAIL PROTECTED] wrote: Leon's message says flat out that adding Apache httpd reduces security, and provides no basis for that statement. A more appropriate statement might have been that Apache does not add any appreciable measure of security as Tomcat provides

Re: Can APR use verisign certs ?

2007-01-09 Thread robert lazarski
On 1/9/07, robert lazarski [EMAIL PROTECTED] wrote: On 1/9/07, Peter Crowther [EMAIL PROTECTED] wrote: From: robert lazarski [mailto:[EMAIL PROTECTED] http://alpha-web01.alphatheory.com/atdev/ The cert's issued to dpt.alphatheory.com; you're testing connections to

Re: Can APR use verisign certs ?

2007-01-09 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Robert, robert lazarski wrote: Can I please ask for more assitence ? I'm getting a date error on this site in both IE6 and firefox 1.5 - 2.0 that I don't understand: https://dpt.alphatheory.com/ I receive no warnings or errors of any kind when

RE: Can APR use verisign certs ?

2007-01-09 Thread Caldarale, Charles R
From: robert lazarski [mailto:[EMAIL PROTECTED] Subject: Re: Can APR use verisign certs ? Can I please ask for more assitence ? I'm getting a date error on this site in both IE6 and firefox 1.5 - 2.0 that I don't understand: https://dpt.alphatheory.com/ I'm getting somewhat different

Re: Help with Tomcat 5.5 mod_jk 1.2.20 loadbalancing sticky session issue

2007-01-09 Thread Carlos Campos
Thank You for your quick reply!! that was it, it works now Carlos. Original Message Follows From: Rainer Jung [EMAIL PROTECTED] Reply-To: Tomcat Users List users@tomcat.apache.org To: Tomcat Users List users@tomcat.apache.org Subject: Re: Help with Tomcat 5.5 mod_jk 1.2.20

Re: Can APR use verisign certs ?

2007-01-09 Thread robert lazarski
On 1/9/07, Caldarale, Charles R [EMAIL PROTECTED] wrote: From: robert lazarski [mailto:[EMAIL PROTECTED] Subject: Re: Can APR use verisign certs ? Can I please ask for more assitence ? I'm getting a date error on this site in both IE6 and firefox 1.5 - 2.0 that I don't understand:

RE: Best way to include common html

2007-01-09 Thread Scott Cowley
The problem is that I can't reference JSP includes from app code if the included file is outside the app's root. (At least with the default installation of Tomcat). -Original Message- From: Scott Purcell [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 09, 2007 1:24 PM To: Tomcat Users

Re: Own logging formatter in webapps

2007-01-09 Thread Boris Unckel
Hello Uwe, Langjahr, Uwe wrote: Hello together, I'm a newbie using Java/Tomcat/JSF-MyFaces all together. Can somebody help me, I have problems with the logging mechanism. - I want to use the JDK logging mechanism in my webapp. - I want to use my own class uxspiweb.log.DebugFormatter for the

Problems with APR install

2007-01-09 Thread Anthony J Biacco
I'm trying to get APR 1.2.8 working with tomcat 5.5.17 which comes with tomcat-native 1.1.3. I'm on RHEL4 on a 64-bit AMD system. I compiled APR from source into /usr/local/apr, compiled tomcat-native with /usr/local/apr, no problems. Added /usr/local/apr/lib to /etc/ld.so.conf and ran ldconfig,

Re: Problems with APR install

2007-01-09 Thread robert lazarski
I think there was a bug on 5.5.17 and apr . See the 5.5.18 changelog . Something to do with ipv6 even though I was running ipv4 . You'll know its working when you see this line: org.apache.coyote.ajp.AjpAprProtocol] Initializing Coyote AJP/1.3 on ajp-0.0.0.0-8009 I got exceptions on 5.5.17 when

Problems with APR install (addendum)

2007-01-09 Thread Anthony J Biacco
Update using strace.. An strace (using: strace -o /var/log/strace.log -f -vvv -F -p) of tomcat showed it opening the tcnative library Single instance: 30114 readlink(/usr/local/apr/lib/libtcnative-1.so, libtcnative-1.so.0.1.3, 4096) = 22 30114 lstat64(0x9434, 0x834c) = 0 30114

RE: Problems with APR install

2007-01-09 Thread Anthony J Biacco
1. The LD_LIBRARY_PATH add didn't add anything to the end, just a : 2. The copy of the tcnative to bin/ didn't help 3. How can I tell if I'm using a 32-bit or 64-bit jvm? I'm assuming if it's 32-bit I'll have to recompile apr and tcnative as 32-bit, if possible? 4. I'll check the 5.5.18 changelog,

Re: How can we use php with tomcat

2007-01-09 Thread Reparto Tecnico - Assistenza
Le Phuoc Canh ha scritto: Can we use php with tomcat ? If anybody know about it, please help me. Thanks Best Regard. I have installed on my Tomcat 5.5.20 the PHP 4.0 ... there are 2 ways : 1) using the famous php servlet phpsrvlt.jar that requires external libraries to work

Re: Best way to include common html

2007-01-09 Thread Leon Rosenberg
Is there actually any real requirements for those html-code portions to be outside of the webapp? If no - move them into the webapp :-) If no - write a custom tag which caches the files via normal FileSystem read and dumps them out in the jsp buffer (of course its better to have a class that

Re: Tomcat and JSTL 1.2

2007-01-09 Thread ben short
Ok I think I know what is going on. I use maven as my build system, and it downloaded the jstl-1.2.jar for me. On looking inside the jar its directory structure seemed a bit odd. /META-INF /classes/org/... /javax/... I edited the file and moved the org and javax directories to the

Re: Securing Tomcat Article for Review

2007-01-09 Thread Markus Schönhaber
Gregor Schneider wrote: On 1/9/07, Markus Schönhaber [EMAIL PROTECTED] wrote: Did you read the article that is subject to this thread? yep I don't think I understand how your post relates to mine. My post relates to yours and to some other posts here in that sense that you (and others)

unable to start tomcat from ant target

2007-01-09 Thread suchitha koneru
am using ant 1.6.2 version. I am having problem with ant target used to start tomcat server. Tomcat server is 5.5.20 version. The target is as follows target name=start_tomcat_server description=starts the tomcat server echo message=starting tomcat server / exec dir=${local.dir}/Tomcat/bin/

Re: Problems with APR install

2007-01-09 Thread robert lazarski
One other thing: If you are using 'java service wrapper' or perhaps some other type of dameon on tomcat , you may not pick up the LD_LIBRARY_PATH . In the 'java service wrapper' case you need to add the dir manually in wrapper.conf . On 1/9/07, Anthony J Biacco [EMAIL PROTECTED] wrote: 1. The

RE: Problems with APR install

2007-01-09 Thread Anthony J Biacco
I think the problem is the 32-bit mixed with 64-bit one you mentioned. The jvm is 32-bit. I tried compiling apr as 32-bit which eventually worked, but apr-util wouldn't. Right now I'm just gonna try installing the 64 bit amd java and be done with it. Thanx, -Tony

Re: Securing Tomcat Article for Review

2007-01-09 Thread Markus Schönhaber
Christopher Schultz wrote: Markus Schönhaber wrote: You defend it yourself in the next paragraph you've written. One could argue that more moving parts equals more complexity, and that complexity is an enemy of security (and I agree). However, there must be a balance. If good security

RE: Problems with APR install

2007-01-09 Thread Anthony J Biacco
Installing the 64-bit JVM fixed it. Thanx! -Tony Anthony J. Biacco Senior Systems/Network Administrator Decentrix Inc. 303-899-4000 x303 -Original Message- From: Anthony J Biacco [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 09, 2007 4:44 PM

Re: Using the balancer app to redirect. Well, trying to... - SOLVED

2007-01-09 Thread Jeremy
Hassan Schroeder wrote: On 1/9/07, Jeremy [EMAIL PROTECTED] wrote: I'm trying to set up a tomcat 5.0.28 instance (on Debian) to achieve redirecting accesses to site1.company.com through to newsite1.org, using the balancer app. rather than apache webserver and the AJP connectors. The easiest

Re: Can APR use verisign certs ?

2007-01-09 Thread Bill Barker
robert lazarski [EMAIL PROTECTED] wrote in message news:[EMAIL PROTECTED] On 1/9/07, Peter Crowther [EMAIL PROTECTED] wrote: From: robert lazarski [mailto:[EMAIL PROTECTED] http://alpha-web01.alphatheory.com/atdev/ The cert's issued to dpt.alphatheory.com; you're testing connections to

Re: Can APR use verisign certs ?

2007-01-09 Thread robert lazarski
On 1/9/07, Bill Barker [EMAIL PROTECTED] wrote: https://dpt.alphatheory.com/ You have the expired intermediate cert for Verisign. As a result, the browser can't verify you because it thinks that the cert that signed yours has expired. You need to get the new one from Verisign and import

  1   2   >