How does a malicious foreign applet come to be on my linux/apache2 web-server where only two ports are listening and most services disabled ? The only way the applets can communicate with the servlets is through an a2s http-tunnel! Does this relate a "threat mode" where the threat comes from within the rank and file ? Assuming single sign-on is available on TC4.0.x (I haven't looked yet), that's two sign-on's that a user needs to get to the goodies, and that is excluding the network sign on. :-o
"Shapira, Yoav" wrote: > > Howdy, > No, you're not right. The two provide different views of security. > Httpd.conf controls apache, not tomcat, and does nothing to prevent, for > example, the execution of malicious applets. Catalina.policy or > whatever you want to call the policy file is used by the JVM security > manager to enforce its policies, including for example applet > sandboxing. If you're not clear what the security manager does, read up > the JDK documentation for it. > > If should use them both if you're concerned about security. > > Yoav Shapira > Millennium ChemInformatics > > >-----Original Message----- > >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > >Sent: Tuesday, August 26, 2003 12:14 AM > >To: [EMAIL PROTECTED] > >Subject: No need for catalina.policy? > > > >Hi > >Please tell me once more. > >Am I right in assumng that I don't really need catalina.policy if I use > >httpd.conf to control access ? > >If t, how do they interact ? > >TIA :-) > > This e-mail, including any attachments, is a confidential business communication, > and may contain information that is confidential, proprietary and/or privileged. > This e-mail is intended only for the individual(s) to whom it is addressed, and may > not be saved, copied, printed, disclosed or used by anyone else. If you are not > the(an) intended recipient, please immediately delete this e-mail from your computer > system and notify the sender. Thank you. > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [EMAIL PROTECTED] > For additional commands, e-mail: [EMAIL PROTECTED]
--------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
