Pier Fumagalli wrote: > Remy Maucherat <[EMAIL PROTECTED]> wrote: > > >>I don't see that much to remove. I assume JNDI is the ever popular >>target, but I didn't notice it causing major problems (either >>performance or reliability), so I'd say it's not worth it. > > > Actually, I have a complaint... 4.1.3 tries to write into my conf directory: > especially the tomcat-users.xml.new file (and since the directory is read > only, the VM falls over). > > Call it defensive administration, but I don't want my engine to write a > single file if it's not where I tell him to do: /tmp. And for sure it must > not attempt to modify my tomcat-users.xml. > > Only _root_ can do that, and if this is one of those things you call > "features", I call it a big huge security hole.
Craig calls it a feature, so talk with him :) The new realm does that. If you look at the server.xml, you will notice you can still use the classic memory realm from 4.0 which doesn't do that instead of the new user database realm. > Attached there is a nice output of my logfile. > > Plus, about that random BOUND socket I had, I noticed it's a leftover > somehow in some friggin' initialization stage... > > My ports are 8005 (control) and 8080 (http/coyote) > > When I start up the thing it's all clear. I start 4.1.2 and notice: > > Local Address Remote Address Swind Send-Q Rwind Recv-Q State > --------------- --------------- ----- ------ ----- ------ --------- > localhost.8080 localhost.47420 32768 0 32768 0 TIME_WAIT > localhost.47422 localhost.47421 32768 0 32768 0 TIME_WAIT > *.8080 *.* 0 0 24576 0 LISTEN > > Why in the world is TC first of all opening a serversocket on port 47421? > (this port number always varies) what's going on here? I don't get that kind of odd behavior on Windows/Cygwin, so I can't help much here. No extra port gets bound in my configuration. Remy -- To unsubscribe, e-mail: <mailto:[EMAIL PROTECTED]> For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>
