user lockout realm, logging ip addresses

2018-08-17 Thread Alex O'Ree
Is it possible to configure the user lockout realm to log what ip address the failed login attempt came from? I know the information needed will also be in the access log but added it to the "attempt to login from a locked account" message would be super helpful. Would it be more advisable to

Re: [tomcat:8.0-jre8] CONFIDENTIAL adds Cache-Control: private?

2018-08-17 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 8/17/18 11:49 AM, Mark Thomas wrote: > On 17/08/18 14:57, Christopher Schultz wrote: >> Mark, >> >> On 8/17/18 4:09 AM, Mark Thomas wrote: >>> On 16/08/18 13:40, Martynas Jusevičius wrote: Hi, my initial observations

Re: [tomcat:8.0-jre8] CONFIDENTIAL adds Cache-Control: private?

2018-08-17 Thread Mark Thomas
On 17/08/18 14:57, Christopher Schultz wrote: > Mark, > > On 8/17/18 4:09 AM, Mark Thomas wrote: >> On 16/08/18 13:40, Martynas Jusevičius wrote: >>> Hi, >>> >>> my initial observations suggest, and SO post [1] seems to >>> confirm, that when >>> >>> >>> CONFIDENTIAL >>> >>> >>> is specified

Re: [tomcat:8.0-jre8] CONFIDENTIAL adds Cache-Control: private?

2018-08-17 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 8/17/18 4:09 AM, Mark Thomas wrote: > On 16/08/18 13:40, Martynas Jusevičius wrote: >> Hi, >> >> my initial observations suggest, and SO post [1] seems to >> confirm, that when >> >> >> CONFIDENTIAL >> >> >> is specified on a

Re: how to prevent user access to JSP pages?

2018-08-17 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 8/17/18 3:54 AM, Mark Thomas wrote: > On 16/08/18 18:19, Berneburg, Cris J. - US wrote: >> Due to security concerns and general fussiness on my part, I'd >> like to prevent users from requesting JSP pages directly, except >> for the login

Re: 2018.03.07-2 Bundle issue with tomcat 8 - Post

2018-08-17 Thread Olaf Kock
On 17.08.2018 15:40, Mandal, Jayanta wrote: Tomcat Version : We upgraded our tomcat environment from bundle 2016.10.31-2 to 2018.03.07-2 & suddenly we are seeing all Post method stopped working with new bundle. Previous Value Changed Value Bundle 2016.10.31-2 2018.03.07-2 Tomcat

RE: 2018.03.07-2 Bundle issue with tomcat 8 - Post

2018-08-17 Thread Mandal, Jayanta
Tomcat Version : We upgraded our tomcat environment from bundle 2016.10.31-2 to 2018.03.07-2 & suddenly we are seeing all Post method stopped working with new bundle. Previous Value Changed Value Bundle 2016.10.31-2 2018.03.07-2 Tomcat Server: : 8.0.18-62_patch_01.ep7.el6.-patch-01

2018.03.07-2 Bundle issue with tomcat 8 - Post

2018-08-17 Thread Mandal, Jayanta
Tomcat Version : We upgraded our tomcat environment from bundle 2016.10.31-2 to 2018.03.07-2 & suddenly we are seeing all Post method stopped working with new bundle. Previous Value Changed Value Bundle 2016.10.31-2 2018.03.07-2 Tomcat Server: : 8.0.18-62_patch_01.ep7.el6.-patch-01

Re: Apache 2.4.33 with mod_jk 1.2.43 keeps shutting down when no Tomcat worker is available

2018-08-17 Thread Martin Knoblauch
Hi, please ignore. There was another component (corosync) that I did not consider. When all tomcats are down, that ends up in a 503 which confused the HA software ... Happy Weekend Martin On Fri, Aug 17, 2018 at 12:15 PM Martin Knoblauch wrote: > Hi, > > we have Apache-2.4.33 as a frontend

Apache 2.4.33 with mod_jk 1.2.43 keeps shutting down when no Tomcat worker is available

2018-08-17 Thread Martin Knoblauch
Hi, we have Apache-2.4.33 as a frontend to a bunch of Tomcats using mod_jk-1.2.43 as load balancer. Since we upgraded to this combination, we observe Apache shutdowns as soon as the last Tomcat worker is down. This has not happened before up until apache-2.4.33+mod_jk-1.2.42. error-log is

Re: [tomcat:8.0-jre8] CONFIDENTIAL adds Cache-Control: private?

2018-08-17 Thread Mark Thomas
On 16/08/18 13:40, Martynas Jusevičius wrote: > Hi, > > my initial observations suggest, and SO post [1] seems to confirm, that when > > > CONFIDENTIAL > > > is specified on a security-constraint in web.xml, Tomcat does two things: > 1. automatically redirects to

Re: how to prevent user access to JSP pages?

2018-08-17 Thread Mark Thomas
On 16/08/18 18:19, Berneburg, Cris J. - US wrote: > Due to security concerns and general fussiness on my part, I'd like to > prevent users from requesting JSP pages directly, except for the login page. > I want all requests to be handled by servlets. That way I can legitimately > claim that