Re: Protecting a cluster from malicious membership

2019-02-11 Thread Keiichi Fujino
2019年2月12日(火) 1:44 Christopher Schultz : > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Mark, > > On 2/11/19 03:49, Mark Thomas wrote: > > On 10/02/2019 14:37, Christopher Schultz wrote: > >> All, > >> > >> I'm looking at the security of Tomcat's Clustering components, > >> and I think

Re: tomcat 8.5.37 specifying PKCS (.pfx) cert files in SSLHostConfig/Certificate elements

2019-02-11 Thread John Palmer
wow. All working now. (I think- verifying the Client Cert prompt - borwser is NOT prompting, but I may not have a cert for it to send) certificateKeystoreFile etc instead of certificateKeyFile and truststoreFile instead of caCertificateFile ( I spent a lot of time searching and trying things.

Re: how to use separate shared dlls for OpenSSL, APR, and libtcnative-1...

2019-02-11 Thread John Palmer
> For Windows, you are better off using the all-in-one statically-linked > DLL provided by the Tomcat team. ... > In general, the Tomcat team tries to keep on top of the latest news > and releases from both APR and OpenSSL, so you shouldn't have to wait > too long between a newly-published

Re: tomcat 8.5.38 change to catalina.sh

2019-02-11 Thread Konstantin Kolinko
вт, 12 февр. 2019 г. в 00:17, Charles Slivkoff : > > More details. > > CATALINA_PID is being defined before calling catalina.sh. > > The 8.5.37 version is storing a PID value, but it is not the correct PID. > Might this have been the reason for the change? > > The 8.5.38 version does not even

Re: tomcat 8.5.38 change to catalina.sh

2019-02-11 Thread Charles Slivkoff
More details. CATALINA_PID is being defined before calling catalina.sh. The 8.5.37 version is storing a PID value, but it is not the correct PID. Might this have been the reason for the change? The 8.5.38 version does not even create the file. I can also see this same behavior on Ubuntu

Fw: tomcat 8.5.38 change to catalina.sh

2019-02-11 Thread Charles Slivkoff
This change in catalina.sh is preventing the PID file from being saved. I don't see this mentioned in the changelog. https://tomcat.apache.org/tomcat-8.5-doc/changelog.html I understand the syntax in both is valid in both cases: single-& verses double-&. I'm observing this on RHEL 6 and 7.

Re: how to use separate shared dlls for OpenSSL, APR, and libtcnative-1...

2019-02-11 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 John, On 2/11/19 10:46, John Palmer wrote: > (I'm new to using TC-native, interested in how to accomplish "In > security conscious production environments, it is recommended to > use separate shared dlls for OpenSSL, APR, and libtcnative-1, and >

Re: tomcat 8.5.37 specifying PKCS (.pfx) cert files in SSLHostConfig/Certificate elements

2019-02-11 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 John, On 2/11/19 10:42, John Palmer wrote: > I'm new to implementing APR/tc-natiive for SSL/TLS on Windows > Server 2008R2, attepting to usse tomcat 8.5.37 specifying PKCS12 > format in the SSLHostConfig/Certificate elements for the keystore > and

Re: Protecting a cluster from malicious membership

2019-02-11 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 2/11/19 03:49, Mark Thomas wrote: > On 10/02/2019 14:37, Christopher Schultz wrote: >> All, >> >> I'm looking at the security of Tomcat's Clustering components, >> and I think that the following are true. Please let me know if >> anything

Re: StaticMembers within Multiple Clusters

2019-02-11 Thread Tim K
On Fri, Jan 18, 2019, 12:44 PM Tim K wrote: > On Fri, Jan 18, 2019 at 11:05 AM Christopher Schultz > wrote: > > > > -BEGIN PGP SIGNED MESSAGE- > > Hash: SHA256 > > > > Tim, > > > > On 1/18/19 06:38, Tim K wrote: > > > Thanks for this. The video helps explain it a bit better than the >

how to use separate shared dlls for OpenSSL, APR, and libtcnative-1...

2019-02-11 Thread John Palmer
(I'm new to using TC-native, interested in how to accomplish "In security conscious production environments, it is recommended to use separate shared dlls for OpenSSL, APR, and libtcnative-1, and update them as needed according to security bulletins. " Apparently I need a concrete example

tomcat 8.5.37 specifying PKCS (.pfx) cert files in SSLHostConfig/Certificate elements

2019-02-11 Thread John Palmer
I'm new to implementing APR/tc-natiive for SSL/TLS on Windows Server 2008R2, attepting to usse tomcat 8.5.37 specifying PKCS12 format in the SSLHostConfig/Certificate elements for the keystore and truststore.. (I would prefer to drop the JKS format for several reasons) questions are: is this

Re: Tomcat 9.0 with security manager reports access denied

2019-02-11 Thread Kai Hofmann
Am 25.01.2019 um 21:58 schrieb Mark Thomas: > On 25/01/2019 20:34, Mark Thomas wrote: >> On 25/01/2019 11:12, Mark Thomas wrote: >>> On 24/01/2019 12:19, Kai Hofmann wrote: Hello, I try to activate the security manager for my own Application within Tomcat 9.0.x. The problem ist

Re: Receiving 403 with Tomcat 9, works with Tomcat 8

2019-02-11 Thread Jörg Schaible
Hi Mark Am Freitag, 8. Februar 2019, 09:30:32 CET schrieb Jörg Schaible: > Hi Mark, > > Am Mittwoch, 6. Februar 2019, 15:32:26 CET schrieb Mark Thomas: > > [snip] > > > You need to set cors.allowed.origin to an appropriate value. See: > >

[ANN] Apache Tomcat 8.5.38 available

2019-02-11 Thread Mark Thomas
The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.38. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and Java Authentication Service Provider Interface for Containers

Re: Tomcat 8.5 SPNEGO Active Directory stuck with a "Failed authenticate() test"

2019-02-11 Thread Mark Thomas
On 08/02/2019 21:43, Michael Osipov wrote: > Am 2019-02-08 um 12:54 schrieb Tommy Schneider: >> Hello, >> >> I'm trying to set up Tomcat 8.5 with SPNEGO in the following environment: >> >> Tomcat: 8.5.37 built: Dec 12 2018 12:07:02 UTC >> Platform/OS:  AIX 7.2 ppc64 >> Java: Eclipse OpenJ9

Re: ant install java.net.ProtocolException: Server redirected too many times (20)

2019-02-11 Thread Mark Thomas
On 08/02/2019 22:37, Barry Kimelman wrote: > I am trying to build an app under tomcat 9-0-14 that I had previously built > under tomcat 7 several years ago. > > however when I run the "ant install" command it fails with the following > errors. > > BUILD FAILED > C:\barry\hockey3\build.xml:369:

Re: session caching on tomcat 7 with APR

2019-02-11 Thread Mark Thomas
On 09/02/2019 19:32, Усманов Азат Анварович wrote: > Hello everyone! I have a webapp running on tomcat 7.0.92 with java 7 with > APR/tomcat native 1.2.19 on RHEL 6 > > I've tested website(debug.ieml.ru) on which my webapp is running on ssllabs > server test and one thing I've noticed is the

Re: migration from tomcat 7.0 to 8.5

2019-02-11 Thread Mark Thomas
On 04/10/2017 15:53, Aquatic Safaris Diver wrote: > > I've read the migration manuals and have tried to make the changes to > my configuration to work correctly in tomcat v8.5, but it's not.  I'm > not an experton XML files and JDK so please help me.   I'm sure this is crazy > simple > for you

Re: Protecting a cluster from malicious membership

2019-02-11 Thread Mark Thomas
On 10/02/2019 14:37, Christopher Schultz wrote: > All, > > I'm looking at the security of Tomcat's Clustering components, and I > think that the following are true. Please let me know if anything in > here is inaccurate: > > 1. a. Default membership uses multicast >b. Multicast (UDP) can't