Re: Why and How Tomcat before Apache?

[Doug Sparling]

--- David Smith <[EMAIL PROTECTED]> wrote:
> That's an unsettling feeling.  
> 
> Never trust incoming form data, but if Tomcat is
> running as a less 
> priveledged user, the potential damage from
> malformed form data is reduced.
> 
> I personally would never run a web app as root just
> for the black hole of 
> security issues dealing with the outside internet.

Do you create a 'tomcat' user? I'm assuming
permissions or owner must be changed under
/usr/local/jakarta-tomcat....

I installed tomcat as root, so all jakarta-tomcat
files are owned by root. I haven't tried this, but I'm
guessing there will be issues running tomcat under
user 'tomcat' without changing persmissions/owner.
Could you give a brief description of how you would do
it?

Thanks.....

__________________________________________________
Do You Yahoo!?
Make international calls for as low as $.04/minute with Yahoo! Messenger
http://phonecard.yahoo.com/