You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by kk...@apache.org on 2017/02/04 10:33:54 UTC
svn commit: r1781652 - in /tomcat/tc6.0.x/trunk: conf/server.xml
webapps/docs/changelog.xml
Author: kkolinko
Date: Sat Feb 4 10:33:53 2017
New Revision: 1781652
URL: http://svn.apache.org/viewvc?rev=1781652&view=rev
Log:
Change Realm configuration in conf/server.xml to use a org.apache.catalina.realm.LockOutRealm
Modified:
tomcat/tc6.0.x/trunk/conf/server.xml
tomcat/tc6.0.x/trunk/webapps/docs/changelog.xml
Modified: tomcat/tc6.0.x/trunk/conf/server.xml
URL: http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/conf/server.xml?rev=1781652&r1=1781651&r2=1781652&view=diff
==============================================================================
--- tomcat/tc6.0.x/trunk/conf/server.xml (original)
+++ tomcat/tc6.0.x/trunk/conf/server.xml Sat Feb 4 10:33:53 2017
@@ -115,12 +115,16 @@
<Valve className="org.apache.catalina.valves.RequestDumperValve"/>
-->
- <!-- This Realm uses the UserDatabase configured in the global JNDI
- resources under the key "UserDatabase". Any edits
- that are performed against this UserDatabase are immediately
- available for use by the Realm. -->
- <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
- resourceName="UserDatabase"/>
+ <!-- Use the LockOutRealm to prevent attempts to guess user passwords
+ via a brute-force attack -->
+ <Realm className="org.apache.catalina.realm.LockOutRealm">
+ <!-- This Realm uses the UserDatabase configured in the global JNDI
+ resources under the key "UserDatabase". Any edits
+ that are performed against this UserDatabase are immediately
+ available for use by the Realm. -->
+ <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
+ resourceName="UserDatabase"/>
+ </Realm>
<!-- Define the default virtual host
Note: XML Schema validation will not work with Xerces 2.2.
Modified: tomcat/tc6.0.x/trunk/webapps/docs/changelog.xml
URL: http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/webapps/docs/changelog.xml?rev=1781652&r1=1781651&r2=1781652&view=diff
==============================================================================
--- tomcat/tc6.0.x/trunk/webapps/docs/changelog.xml (original)
+++ tomcat/tc6.0.x/trunk/webapps/docs/changelog.xml Sat Feb 4 10:33:53 2017
@@ -53,6 +53,16 @@
</fix>
</changelog>
</subsection>
+ <subsection name="Other">
+ <changelog>
+ <update>
+ Change Realm configuration in the default <code>conf/server.xml</code>
+ file to use a <code>org.apache.catalina.realm.LockOutRealm</code>.
+ The <code>LockOutRealm</code> is available since 6.0.19, but has
+ not been configured by default. (kkolinko)
+ </update>
+ </changelog>
+ </subsection>
</section>
<section name="Tomcat 6.0.50 (violetagg)" rtext="not released">
<subsection name="Web applications">
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org