configured truststore ignored by tomcat

2012-09-19 Thread Marco_Strullato
Hi all, I have a tomcat 6.0.35 that needs to connect to a remote server using https, so it is acting as a https client: it means that tomcat must have the remote server certificate installed. The ideal solution I found is to configure the truststore in the server.xml. Please see the

exploting tomcat vulnerability with example

2012-09-19 Thread Ragini
Hi all, For my research work I want to have different attacking scenarios which exploits vulnerability of JAVA based applications. This java applications can be just any web-application, desktopapplication or any other. For this, I was thinking to exploit vulnerabilities of tomcat itself

Re: exploting tomcat vulnerability with example

2012-09-19 Thread chris derham
On Wed, Sep 19, 2012 at 10:02 AM, Ragini raginippa...@gmail.com wrote:For my research work I want to have different attacking scenarios which exploits vulnerability of JAVA based applications. This java applications can be just any web-application, desktopapplication or any other.For this, I was

Re: exploting tomcat vulnerability with example

2012-09-19 Thread Ragini
On 09/19/2012 01:49 PM, chris derham wrote: On Wed, Sep 19, 2012 at 10:02 AM, Ragini raginippa...@gmail.com wrote:For my research work I want to have different attacking scenarios which exploits vulnerability of JAVA based applications. This java applications can be just any web-application,

Re: Accessing CoyoteRequest attributes in a Servlet

2012-09-19 Thread André Warnier
Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 André, On 9/18/12 9:47 AM, André Warnier wrote: Still talking about mod_jk, basically anything you set in Apache httpd using SetEnv for example, gets passed to Tomcat as a request attribute, through the AJP protocol.

Re: exploting tomcat vulnerability with example

2012-09-19 Thread Daniel Mikusa
On Sep 19, 2012, at 5:02 AM, Ragini wrote: Hi all, For my research work I want to have different attacking scenarios which exploits vulnerability of JAVA based applications. This java applications can be just any web-application, desktopapplication or any other. For this, I was

Re: Latest Tomcat release question...

2012-09-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Tony, On 9/18/12 7:10 PM, Tony Anecito wrote: Thanks for the heads up about the memory issue. I looked over the release notes before I posted here and did not remember reading that. http://tomcat.apache.org/tomcat-7.0-doc/changelog.html It's

Updating Tomcat-Server from Version 6.0.16 to 7.0.30

2012-09-19 Thread Andreas Stadelmeier
Hello guys, i would like to install the newest stable version of the Apache Tomcat Server. I already got some stuff running on the old Tomcat v.6.0.16 Server. I want to ask you, if it is safe to do this update and if afterwards my v 6 compatible JSP-Files wont cause any problems. Thank you in

Re: configured truststore ignored by tomcat

2012-09-19 Thread Daniel Mikusa
On Sep 19, 2012, at 2:40 AM, marco_strull...@swissre.com wrote: Hi all, I have a tomcat 6.0.35 that needs to connect to a remote server using https, so it is acting as a https client: it means that tomcat must have the remote server certificate installed. The ideal solution I found is

Tomcat Connector for Sun ONE Web Server 7.0 and Tomcat 6.0.x

2012-09-19 Thread Jay Rao
Is there a Tomcat Connector for Sun ONE Web Server 7.0 and Tomcat 6.0.x running on RedHat Linux 5.7 64-bit ? If not, any idea on when will it would be available please ?

Re: Latest Tomcat release question...

2012-09-19 Thread Tony Anecito
Ok does scanning scan the classes inside the library jars the app uses? What would be the point of that?   Thanks, -Tony --- On Wed, 9/19/12, Christopher Schultz ch...@christopherschultz.net wrote: From: Christopher Schultz ch...@christopherschultz.net Subject: Re: Latest Tomcat release

Re: Tomcat Connector for Sun ONE Web Server 7.0 and Tomcat 6.0.x

2012-09-19 Thread Hassan Schroeder
On Wed, Sep 19, 2012 at 8:02 AM, Jay Rao jay...@gmail.com wrote: Is there a Tomcat Connector for Sun ONE Web Server 7.0 and Tomcat 6.0.x running on RedHat Linux 5.7 64-bit ? If not, any idea on when will it would be available please ? My guess: When dead, dreaming Cthulhu wakes in his house

sessions replication

2012-09-19 Thread Carrillo, Dan
Hi folks, My sessions are replicating across the cluster as indicated by my session listener debug output. E.g I can see the session created/destroyed messages in each respective log. I have a Service object that is serializable, which contains a String member variable (x) which is not

Re: mod_jk vs. mod_proxy

2012-09-19 Thread Shanti Suresh
Hi Chris, Appreciate your feedback. That is helpful. Thanks you! -Shanti On Tue, Sep 18, 2012 at 3:33 PM, Christopher Schultz ch...@christopherschultz.net wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Shanti, On 9/18/12 10:04 AM, Shanti Suresh wrote:

Re: exploting tomcat vulnerability with example

2012-09-19 Thread Pid *
On 19 Sep 2012, at 13:20, Daniel Mikusa dmik...@vmware.com wrote: On Sep 19, 2012, at 5:02 AM, Ragini wrote: Hi all, For my research work I want to have different attacking scenarios which exploits vulnerability of JAVA based applications. This java applications can be just any

Re: Updating Tomcat-Server from Version 6.0.16 to 7.0.30

2012-09-19 Thread Pid *
On 19 Sep 2012, at 14:45, Andreas Stadelmeier a...@michlaustderaffe.de wrote: Hello guys, i would like to install the newest stable version of the Apache Tomcat Server. I already got some stuff running on the old Tomcat v.6.0.16 Server. I want to ask you, if it is safe to do this update and

Re: Latest Tomcat release question...

2012-09-19 Thread Pid *
On 19 Sep 2012, at 16:45, Tony Anecito adanec...@yahoo.com wrote: Ok does scanning scan the classes inside the library jars the app uses? What would be the point of that? How does Tomcat know which is a special library jar and which is not? (Unless you provide it with a list of jars to

Re: Tomcat Connector for Sun ONE Web Server 7.0 and Tomcat 6.0.x

2012-09-19 Thread Pid *
On 19 Sep 2012, at 16:59, Hassan Schroeder hassan.schroe...@gmail.com wrote: On Wed, Sep 19, 2012 at 8:02 AM, Jay Rao jay...@gmail.com wrote: Is there a Tomcat Connector for Sun ONE Web Server 7.0 and Tomcat 6.0.x running on RedHat Linux 5.7 64-bit ? If not, any idea on when will it would be

Re: sessions replication

2012-09-19 Thread Pid *
On 19 Sep 2012, at 16:59, Carrillo, Dan dcarri...@idanalytics.com wrote: Hi folks, My sessions are replicating across the cluster as indicated by my session listener debug output. E.g I can see the session created/destroyed messages in each respective log. I have a Service object that is

Re: Is there a REAL solution to the BEAST attack (CVE-2011-3389) for Tomcat 7.x

2012-09-19 Thread Pid *
Martin, You know what a turtle is? p On 15 Sep 2012, at 13:30, Martin Gainty mgai...@hotmail.com wrote: Good Morning Brian from what Im seeing this is a Redhat Enterprise 4,5,6 bug which effects any of the secure protocols such as sftp, scp and ssl and you would need to implement the

Re: Profiling tomcat 7 on ubuntu with java profiler

2012-09-19 Thread Pid *
On 17 Sep 2012, at 13:55, Ragini raginippa...@gmail.com wrote: Hi experts, I profile tomcat with a java profiler. I expect that a Java Profiler is the best way to do that. The profiler runs java agent and profiles the tomcat server. So you said. That's awesome dude. So I have created

Re: R: how to read files in file system

2012-09-19 Thread Pid *
On 18 Sep 2012, at 07:22, Ge Gestione Elaboratori(IBM Business Partner) case...@gmail.com wrote: Excuse me Dan: attached the screenshot. Zeesh. Stop attaching it, paste some info inline in the message and stop being lazy. p paolo -Messaggio originale- Da: Daniel Mikusa

Re: Latest Tomcat release question...

2012-09-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Tony, On 9/19/12 11:44 AM, Tony Anecito wrote: Ok does scanning scan the classes inside the library jars the app uses? What would be the point of that? As previously discussed, this is a (somewhat foolish) requirement of the servlet

Re: sessions replication

2012-09-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Pid, On 9/19/12 2:08 PM, Pid * wrote: On 19 Sep 2012, at 16:59, Carrillo, Dan dcarri...@idanalytics.com wrote: Hi folks, My sessions are replicating across the cluster as indicated by my session listener debug output. E.g I can see the

Best practices for upgrading Tomcat on Windows?

2012-09-19 Thread David A. Rush
Is there a set of best practices documented anywhere for upgrading Tomcat on Windows? I run Tomcat as a Windows service on several machines. I can, and have many times, completely removed Tomcat and reinstalled a new version, but there's probably a better way, particular for minor version

very basic question about apache and tomcat

2012-09-19 Thread Mead, Jen L
Hi Everybody, Now I will show my real ignorance about what I know after NOT working with Apache or Tomcat for several years now. I have been working on a project that allows our CGI web pages to authenticate users from their windows desktop against Windows AD and not requiring any kind of

ajp_ilink_receive error - please advise

2012-09-19 Thread Django Radonich-Camp
hello. we are running an application on tomcat and experiencing intermittent periods where the application is non-responsive and thus non-functional. the general set up is apache and tomcat, with mod_proxy_ajp as the connector (specific details and configs below). during these events, the

Re: very basic question about apache and tomcat

2012-09-19 Thread David A. Rush
On 2012-09-19 17:31, Mead, Jen L wrote: My basic question is: do I need to install apache as well as tomcat to have an httpd.conf file? I have tomcat running on several AIX servers, 6.1 and 5.3, with tomcat 7.0.27 installed. I was doing a simple search to find the httpd.conf file when I

RE: very basic question about apache and tomcat

2012-09-19 Thread Mead, Jen L
That was very insightful. All the documentation that I am looking into specifies apache as the application. Maybe, just maybe the server.xml file will contain what I need to move forward. The lack of documentation for what I am trying to do is frustrating. I am not even sure I can do it

Re: Best practices for upgrading Tomcat on Windows?

2012-09-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 David, On 9/19/12 4:32 PM, David A. Rush wrote: Is there a set of best practices documented anywhere for upgrading Tomcat on Windows? I run Tomcat as a Windows service on several machines. I can, and have many times, completely removed Tomcat

Re: ajp_ilink_receive error - please advise

2012-09-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Django, On 9/19/12 5:38 PM, Django Radonich-Camp wrote: apache: Apache/2.2.14 That's 9 revisions out of date. Any chance you can upgrade to 2.2.23 and re-test? Is it reliably reproducible? - -chris -BEGIN PGP SIGNATURE- Version:

Re: very basic question about apache and tomcat

2012-09-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 David, On 9/19/12 5:45 PM, David A. Rush wrote: On 2012-09-19 17:31, Mead, Jen L wrote: My basic question is: do I need to install apache as well as tomcat to have an httpd.conf file? I have tomcat running on several AIX servers, 6.1 and 5.3,

Re: very basic question about apache and tomcat

2012-09-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jen, On 9/19/12 5:52 PM, Mead, Jen L wrote: That was very insightful. All the documentation that I am looking into specifies apache as the application. Maybe, just maybe the server.xml file will contain what I need to move forward. The lack of

Re: very basic question about apache and tomcat

2012-09-19 Thread Jeff
I have a related question since we recently implemented authentication to AD via LDAP in our Tomcat WebApp but it currently prompts the user for every new session, even if they are hitting the site from their windows workstation that is already authenticated to the domain. Is there a way to do it

Proxy Support in tomcat 7

2012-09-19 Thread Vijay Kumar
Hi all, I have a scenario where i don't want to contact from my application to a web-service using https. I don't want to change firewall details and want to enable 443 port. Is there any way that can configure a proxy and can handle this scenario. My application is deployed at tomcat 7