Securing Tomcat on FC8

["Hyatt, Gordon" <Go...@joslin.harvard.edu>]

I've just finished reading the Tomcat Security chapter of O'Reilly's
Tomcat, The Definitive Guide that covers Tomcat 4 and have been left
with many questions.

First, a little background: I've setup a new web server on FC8 x86_64
running Sun Java 1.6.0_05 and tomcat 5.5.26.  I'm very familiar with
Tomcat on Windows (developed and deployed there for many years), and am
now moving to Linux for various reasons.  I have some experience on
Linux and am looking to improve.  The server is in my company's data
center and only ports 80 and 443 are visible to the outside.  The local
Linux guru is out this week and next, so I thought I'd at least start.

Because this will be a web server, Tomcat will need to listen on ports
80 and 443.  In order to do so, as I understand it, Tomcat needs to be
run as root - something with which I'm not very comfortable.  So the
main question is:

How do I get Tomcat to listen on 80 and 443 without running as root?  

I thought of running Tomcat in a chroot jail, but that won't completely
work, as it still needs to run as root for listening on these privileged
ports.  I've also thought about setting up port forwarding from 80 and
443 to, say, 8180 and 8543.  

I guess I'm looking for some advice/pointers/references for the "best"
way to secure tomcat.  

Any suggestions?


Thanks, in advance.

Gord





---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Securing Tomcat on FC8

[Steve Ochani <oc...@ncc.edu>]

Date sent:      	Fri, 28 Mar 2008 16:07:26 -0400
From:           	"Hyatt, Gordon" <Go...@joslin.harvard.edu>
Subject:        	Securing Tomcat on FC8
To:             	users@tomcat.apache.org
Send reply to:  	Tomcat Users List <us...@tomcat.apache.org>

> I've just finished reading the Tomcat Security chapter of O'Reilly's
> Tomcat, The Definitive Guide that covers Tomcat 4 and have been left
> with many questions.
> 
> First, a little background: I've setup a new web server on FC8 x86_64

If security is a concern for you then dump Fedora as your Linux distro. Fedora is not meant to 
be run on productions systems.

If you are looking for a free but well supported (as in security patches) for an extended period 
of time I would recommend CentOS which is a clone of Red Hat Enterprise Linux. Others 
also recommend debian.


> running Sun Java 1.6.0_05 and tomcat 5.5.26.  I'm very familiar with
> Tomcat on Windows (developed and deployed there for many years), and
> am now moving to Linux for various reasons.  I have some experience on
> Linux and am looking to improve.  The server is in my company's data
> center and only ports 80 and 443 are visible to the outside.  The
> local Linux guru is out this week and next, so I thought I'd at least
> start.
> 
> Because this will be a web server, Tomcat will need to listen on ports
> 80 and 443.  In order to do so, as I understand it, Tomcat needs to be
> run as root - something with which I'm not very comfortable.  So the
> main question is:
> 
> How do I get Tomcat to listen on 80 and 443 without running as root?  
> 

Use jsvc.

http://tomcat.apache.org/tomcat-5.5-doc/setup.html


> I thought of running Tomcat in a chroot jail, but that won't
> completely work, as it still needs to run as root for listening on
> these privileged ports.  I've also thought about setting up port
> forwarding from 80 and 443 to, say, 8180 and 8543.  
> 
> I guess I'm looking for some advice/pointers/references for the "best"
> way to secure tomcat.  
> 
> Any suggestions?
> 

This is a guide which has been quoted/linked by others on this list and has some good tips.

http://www.owasp.org/index.php/Securing_tomcat


-Steve O.



---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Securing Tomcat on FC8

["Mark H. Wood" <mw...@IUPUI.Edu>]

Aside from packet-mangling the port numbers between the interface(s)
and Tomcat's sockets, there are two other ways to use "privileged"
ports but not run Tomcat with special privilege:

1.  Run behind something like Apache HTTPD, which already does the
    privilege separation for you.  This is a heavyweight approach,
    probably too heavy if you don't have any other reason to run
    HTTPD.  (Reasons would include already having HTTPD for other
    purposes, or needing some esoteric module whose function hasn't made
    its way into Tomcat yet.)

2.  Commons Daemon, also known as 'jsvc'.  This is what most people
    will recommend.  They never say how it works, though, so I
    investigated a little, and now I think I'm ready to believe in it.

    jsvc is a native program which, after daemonizing itself, will
    start up a JVM, have it load a given class, and invoke several
    methods of that class.

    jsvc will bring up a daemon in two stages.  In the first stage it
    runs as the invoker's UID (e.g. root) and calls a method in a
    given class to set up privileged stuff like low-numbered ports.
    Then it changes to a given UID and calls another method to
    actually run the daemon's service.  This is a rather clever way of
    leveraging Java's classloading features to achieve the same effect
    as familiar privilege-dropping, without forking and with isolation
    of the platform-specific code in a single executable.  Anyway,
    recent Tomcat exposes the necessary methods to be run by jsvc.

I don't use jsvc yet, but I want to experiment a bit and eventually
submit patches to Gentoo to replace the current complicated rigmarole
in their Tomcat startup script with something simpler built around
jsvc.

-- 
Mark H. Wood, Lead System Programmer   mwood@IUPUI.Edu
Typically when a software vendor says that a product is "intuitive" he
means the exact opposite.