You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Miguel Torres Fernández <mi...@juntadeandalucia.es> on 2009/10/26 10:54:14 UTC
Set System variables.
Good Morning.
At firts say hello, this is my first message to the list.
I'm a system admin and i have a problem with applications thats set
system variables like proxy of the system (system.setProperties). It's a
big problem for us, i have an instance of tomcat with more than ten
applications and the past week two of them modify parameters of the
system like proxy or trustkeystore.
Exist some jdk options to avoid applications to set this parameters?
Thanks in advance.
--
Miguel Torres Fernández
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Set System variables.
Posted by Miguel Torres Fernández <mi...@juntadeandalucia.es>.
Peter Crowther escribió:
> 2009/10/26 Miguel Torres Fernández <mi...@juntadeandalucia.es>:
>
>> At firts say hello, this is my first message to the list.
>>
>
> Welcome!
>
>
>> I'm a system admin and i have a problem with applications thats set system
>> variables like proxy of the system (system.setProperties). It's a big
>> problem for us, i have an instance of tomcat with more than ten applications
>> and the past week two of them modify parameters of the system like proxy or
>> trustkeystore.
>>
>> Exist some jdk options to avoid applications to set this parameters?
>>
>
> Not JDK, but you can run Tomcat with a security manager to prevent
> such calls. You've not told us which version of Tomcat you're
> running, so I'll link the most recent (Tomcat 6.0.x) document:
> http://tomcat.apache.org/tomcat-6.0-doc/security-manager-howto.html
>
> Tuning the security manager often takes quite a lot of work, as you
> need to find out what to allow as well as what to deny.
>
> - Peter
>
Oh, it's true.
I'm running tomcat 5.5.27 with jdk 1.5.0_18 under Red Hat 5. Only one
instance in two servers cluster.
Now, i'm reading about security-manager.
Thanks.
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
>
--
Miguel Torres Fernández
Consejería de Empleo
Servicios Centrales (Asistencia Linux)
asistencialinux.cem@juntadeandalucia.es
Avda. Hytasa nº 14.
(955048979 - RCJA. 348979)
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Set System variables.
Posted by Peter Crowther <pe...@melandra.com>.
2009/10/26 Miguel Torres Fernández <mi...@juntadeandalucia.es>:
> At firts say hello, this is my first message to the list.
Welcome!
> I'm a system admin and i have a problem with applications thats set system
> variables like proxy of the system (system.setProperties). It's a big
> problem for us, i have an instance of tomcat with more than ten applications
> and the past week two of them modify parameters of the system like proxy or
> trustkeystore.
>
> Exist some jdk options to avoid applications to set this parameters?
Not JDK, but you can run Tomcat with a security manager to prevent
such calls. You've not told us which version of Tomcat you're
running, so I'll link the most recent (Tomcat 6.0.x) document:
http://tomcat.apache.org/tomcat-6.0-doc/security-manager-howto.html
Tuning the security manager often takes quite a lot of work, as you
need to find out what to allow as well as what to deny.
- Peter
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Set System variables.
Posted by Miguel Torres Fernández <mi...@juntadeandalucia.es>.
André Warnier escribió:
> Miguel Torres Fernández wrote:
>> Good Morning.
>>
>> At firts say hello, this is my first message to the list.
>>
>> I'm a system admin and i have a problem with applications thats set
>> system variables like proxy of the system (system.setProperties).
>> It's a big problem for us, i have an instance of tomcat with more
>> than ten applications and the past week two of them modify parameters
>> of the system like proxy or trustkeystore.
>>
>> Exist some jdk options to avoid applications to set this parameters?
>>
> Hola Miguel.
> Simple answer : don't run these applications. The developers of these
> applications should know that when they set such a "system" property,
> it sets it for the entire JVM, and they should think about the
> consequences.
>
> As a sysadmin, you can probably forbid these applications from doing
> that, by running Tomcat with a security manager. Look at the Tomcat
> startup scripts to see if there are default options being loaded
> somewhere. If you are under Linux, you may find something in, for
> example, /etc/defaults/tomcat.
>
> But the problem is, such a security manager is also valid for the
> entire JVM, and thus the entire Tomcat and all its (other) applications.
> So you may have to do a lot of individual tuning of the permissions of
> each application, just to control these two misbehaving applications.
>
> Also, by setting these permissions, the most likely result is that
> these two applications will now crash, since they will get a
> permission error when they try to do what they do.
>
> So, back to the simple answer above.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Hello André!
The first step, as work arround, has been put this apps in quarantine,
the other apps needs to be in production, but now I need to make a
system to avoid future apps to set this parameters. If bad apps doesn't
work it not my fault and i told the developers which problems involve
their apps and that they need to fix it.
Thank you very much.
--
Miguel Torres Fernández
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Set System variables.
Posted by André Warnier <aw...@ice-sa.com>.
Miguel Torres Fernández wrote:
> Good Morning.
>
> At firts say hello, this is my first message to the list.
>
> I'm a system admin and i have a problem with applications thats set
> system variables like proxy of the system (system.setProperties). It's a
> big problem for us, i have an instance of tomcat with more than ten
> applications and the past week two of them modify parameters of the
> system like proxy or trustkeystore.
>
> Exist some jdk options to avoid applications to set this parameters?
>
Hola Miguel.
Simple answer : don't run these applications. The developers of these
applications should know that when they set such a "system" property, it
sets it for the entire JVM, and they should think about the consequences.
As a sysadmin, you can probably forbid these applications from doing
that, by running Tomcat with a security manager. Look at the Tomcat
startup scripts to see if there are default options being loaded
somewhere. If you are under Linux, you may find something in, for
example, /etc/defaults/tomcat.
But the problem is, such a security manager is also valid for the entire
JVM, and thus the entire Tomcat and all its (other) applications.
So you may have to do a lot of individual tuning of the permissions of
each application, just to control these two misbehaving applications.
Also, by setting these permissions, the most likely result is that these
two applications will now crash, since they will get a permission error
when they try to do what they do.
So, back to the simple answer above.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org