Hash: SHA256


On 2/13/20 5:05 AM, logo wrote:
> Am 2020-02-13 10:57, schrieb Olivier Jaquemet:
>> On 13/02/2020 10:32, Rémy Maucherat wrote:
>>> On Thu, Feb 13, 2020 at 9:33 AM Olivier Jaquemet wrote:
>>>> On 13/02/2020 01:02, Stefan Mayr wrote:
>>>>>> - AJP defaults changed to listen the loopback address,
>>>>>> require a secret and to be disabled in the sample
>>>>>> server.xml
>>>>> [snip]
>>>> Am I correct ? Why such a change ? Why no bugzilla issue for
>>>> proper tracking and context ? What are your recommendations
>>>> regarding AJP connector configuration ?
>>> It is obviously best to keep default configurations as stable
>>> as possible. But sometimes things have to change ... As a
>>> result, you'll indeed need to adjust your server.xml according
>>> to your deployment and AJP usage.
>> Thank you Rémy for taking the time to answer.
>> I understand the need to introduce a "secured by default" AJP 
>> configuration. However, I question one choice that was made for
>> this change : the default behavior of the AJP connector to listen
>> only on the loopback address.
> +1
>> This is the change which is, to me, the most questionable one.
>> Because to my understanding, any architecture in which a remote
>> Apache HTTPD is being used will require a *specific IP address of
>> the current host* to be specified in the address attribute of the
>> AJP connector. A specific IP address means that the server.xml is
>> no longer agnostic to the platfom it is being hosted on. Prior to
>> this, a server.xml file could be configured in such way that it
>> would never contain any hard coded value related to the current
>> host. With this change it is no longer possible. (unless I'm
>> missing something). For large deployment configuration, this does
>> seems a bit problematic. Do you understand my concern ? Is there
>> any way to address this ?
> That's really difficult. Specifically in container environments
> where the container is started dynamically and the ip address
> shifts frequently. Access is done through dns or labels.

My question would be "why do so many have AJP connectors where no
'address' attribute was specifically configured?"

The answer to the question "why change the default?" is: "because the
default was essentially insecure, in a way that wasn't obvious to
someone who wasn't paying close attention."

So we are forcing users to pay closer attention. If you want to open
your AJP instance to the "whole world", then you can explicitly bind
to just as the previous default. Similarly, if you don't
want to use the "secret" setting, then you can explicitly disable it.
But the defaults will no longer let you be "insecure" without knowing it

Obviously, there are ways to have a "secure" installation while using and/or secretRequired="false". But having those things in
the configuration right in front of you make it clear that some
decision has been made, rather than hiding (potential) danger behind
insecure defaults.

Why make this change in a point-release and not a major one? Because
we felt it was important enough to do so.

Will this disrupt some environments? Yes, it will. But the path to
fixing it is to make one (or two) small edits to your configuration
files which are surely under revision-control and automatically
pushed-out to these hundreds-of-nodes clusters everyone is worried
about, right? Well, then, change your configs and push them out there
along with your upgrade of Tomcat and all will be well.

- -chris
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/


To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Reply via email to