On Fri, 17 Aug 2001, David Smith wrote:
> That's an unsettling feeling.
>
> Never trust incoming form data, but if Tomcat is running as a less
> priveledged user, the potential damage from malformed form data is reduced.
>
> I personally would never run a web app as root just for the black hole of
> security issues dealing with the outside internet.
>
> My two cents on the subject.
>
An additional measure of control you have with Tomcat is to run it under a
Java security manager. When you do this, you can manage very fine grained
control over what a particular web app is allowed to do (for example, you
can access *this* TCP port on *that* server because it's your database,
but no others). This works whether you run as root or not, if you use the
"-security" option on the command line when you start up Tomcat.
There's a HOW-TO document on this in the Tomcat 3.x docs (soon to be
ported for 4.x), and Glenn Nielsen did a great ApacheCon session on using
security managers with Tomcat at ApacheCon US 2001 last March -- I'm sure
he'd be willing to forward a pointer to where the slides are available.
> --David
>
Craig
> On Friday 17 August 2001 11:38 am, you wrote:
> > Yes.. as root!
> >
> > R.
> >
> > ----- Original Message -----
> > From: "David Cassidy" <[EMAIL PROTECTED]>
> > To: <[EMAIL PROTECTED]>
> > Sent: Friday, August 17, 2001 5:08 PM
> > Subject: Re: Why and How Tomcat before Apache?
> >
> > > check out if you can do a rm -rf * from within java...
> > >
> > > Don't know if you can, don't know how well the JVM will
> > > protect you but
> > >
> > > I run mine as a different user.
> > >
> > > Do you run your apache as root ?
> > >
> > > David
> > >
> > > Martin van den Bemt wrote:
> > > > Please tell me what is dangerous about running tomcat as root? I've
> > > > taken
> > > > the following security measures :
> > > > port 8007 and 8009 is blocked from the outside (firewall)
> > > > tomcat is not running on 8080 and only allowing communications from
> > > > localhost (127.0.0.1).
> > > > The only potential problem is that if a tomcat /apache bug is
> > > > exploited, you potentially have a problem.
> > > >
> > > > Looks pretty solid to me though..
> > > >
> > > > Mvgr,
> > > > martin
> > > >
> > > > > -----Original Message-----
> > > > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On
> > > >
> > > > Behalf
> > > >
> > > > > Of David Cassidy
> > > > > Sent: Friday, August 17, 2001 4:54 PM
> > > > > To: [EMAIL PROTECTED]
> > > > > Subject: Re: Why and How Tomcat before Apache?
> > > > >
> > > > >
> > > > > unless you want to run your tomcat as root ( Very unwise )
> > > > > makesure that you use a 'su' command in your
> > > > > call to tomcat's start script...
> > > > >
> > > > >
> > > > >
> > > > > David
> > > > >
> > > > > Rui Miguel Seabra wrote:
> > > > > > Just hack apachectl script to launch tomcat just before apache, and
> > > >
> > > > to
> > > >
> > > > > > shut it down right aftwards.
> > > > > >
> > > > > > On 17 Aug 2001 16:43:41 +0200, Roberto B. wrote:
> > > > > > > Ok ! but.. do you know the way to make this in automatic ( with
> > > > > >
> > > > > > scripts at
> > > > > >
> > > > > > > system start ) ??
> > > > > > >
> > > > > > > ----- Original Message -----
> > > > > > > From: "Barnabas Yohannes" <[EMAIL PROTECTED]>
> > > > > > > To: <[EMAIL PROTECTED]>
> > > > > > > Sent: Friday, August 17, 2001 3:39 PM
> > > > > > > Subject: Re: Why and How Tomcat before Apache?
> > > > > > >
> > > > > > > > I cannot answer your "why" question, because, I am not one of
> > > >
> > > > the
> > > >
> > > > > > > developers
> > > > > > >
> > > > > > > > of apache or tomcat. But here is the answer to your "how"
> > > >
> > > > question:
> > > > > > > > *To stop and start your tomcat:
> > > > > > > >
> > > > > > > > cd /usr/local/tomcat
> > > > > > > >
> > > > > > > > bin/shutdown.sh
> > > > > > > >
> > > > > > > > bin/startup.sh
> > > > > > > >
> > > > > > > > *Exit from tomcat and go to your apache server:
> > > > > > > >
> > > > > > > > su
> > > > > > > >
> > > > > > > > /usr/local/apache/bin/apachectl restart
> > > > > > > >
> > > > > > > > exit
> > > > > > > >
> > > > > > > > * Another way of stopping and starting apache:
> > > > > > > >
> > > > > > > > bin/apachectl stop
> > > > > > > > bin/apachectl start
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > ----- Original Message -----
> > > > > > > > From: "Roberto B." <[EMAIL PROTECTED]>
> > > > > > > > To: <[EMAIL PROTECTED]>
> > > > > > > > Sent: Friday, August 17, 2001 4:50 AM
> > > > > > > > Subject: Why and How Tomcat before Apache?
> > > > > > > >
> > > > > > > > > I have a Linux/Debian system.
> > > > > > > > > I want to use Apache as web-server and Tomcat only for JSP
> > > >
> > > > file.
> > > >
> > > > > > > > > Is it true that it is necessary to make start Tomcat before
> > > > > >
> > > > > > Apache?
> > > > > >
> > > > > > > Why?..
> > > > > > >
> > > > > > > > > and if it is true.. how??
> > > > > > > > >
> > > > > > > > > Thanks!
> > > > > > > > > Roberto.
> > > > > >
> > > > > > --
> > > > > > + No matter how much you do, you never do enough -- unknown
> > > > > > + Whatever you do will be insignificant,
> > > > > >
> > > > > > | but it is very important that you do it -- Ghandi
> > > > > >
> > > > > > + So let's do it...?
>
