You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Peter Stavrinides <p....@albourne.com> on 2007/07/26 09:51:01 UTC
Tomcat 5 and 6 Security advise
Hi all,
I need some advice with regards to Tomcat security, my company is not
convinced about Tomcat's security, I work for a financial institution so
you might understand their paranoia.
My question is how best to secure a Java servlet that runs on Tomcat.
Requests are routed through front end servers running Apache on separate
physical machines. Should I configure in addition an Apache server
locally or is Tomcat okay without it, my feeling is that this is not
necessary.
Tomcat uses a JDBC realm to connect to a database for authentication, we
use SSL and the machines are pretty well locked down. Is there anything
else that should be considered? Does Apache offer something extra so
that Tomcat should run with its own Apache web server bearing in mind we
use only Java.
Thanks for your help,
Peter
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat 5 and 6 Security advise
Posted by Craig Skinner <cr...@kepax.co.uk>.
On Thu, Jul 26, 2007 at 03:24:28PM +0300, Peter Stavrinides wrote:
> It makes for interesting reading, however it was written for Tomcat 4...
> how current is it?? and nothing is mentioned about the benefits of
> running Apache with Tomcat for securing Tomcat in a purely Java
> environment, please read the question Craig!
Oh, so you are the one that uses the JavaOS. I was wondering who it was.
Since you are interested in security, I assume that you are using some
sort of UNIX-a-like OS, and that reference discusses chroot, user id's,
packet filtering, etc, etc. These things don't change much WRT TC
release points.
If you are using Solaris, as I guess you are since you work for thieves,
err, a financial company, then you could use zones for tomcat & apache.
I guess you missed the items in the pdf that Chuck spoon fed you.
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat 5 and 6 Security advise
Posted by Peter Stavrinides <p....@albourne.com>.
Thanks Chuck,
I have done most of these, I already run Tomcat as a daemon using a
non-privileged account, and use a JDBC realm to authenticate users. I
will check for any loose ends like connectors in the config files.
Peter
Caldarale, Charles R wrote:
>> From: Peter Stavrinides [mailto:p.stavrinides@albourne.com]
>> Subject: Re: Tomcat 5 and 6 Security advise
>>
>> and nothing is mentioned about the benefits of
>> running Apache with Tomcat for securing Tomcat
>> in a purely Java environment
>>
>
> Adding layers generally doesn't improve security - it just provides
> additional targets.
>
> Some things to do:
>
> 1) Browse through the server.xml and web.xml settings in Tomcat's conf
> directory, and disable anything you don't need, especially connectors.
>
> 2) Remove any uneeded webapps that come with Tomcat, such as the
> examples, docs, and webdav.
>
> 3) Use a proper authentication Realm, not the toy default one that keeps
> credentials in the tomcat-users.xml file.
>
> 4) Restrict access to Tomcat's file structure to a specific userid, and
> run Tomcat with that userid.
>
> I'm not aware of any security vulnerabilities in current Tomcat levels
> other than the rather minor cross-scripting ones inherent in some of the
> examples.
>
> - Chuck
>
>
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
> MATERIAL and is thus for use only by the intended recipient. If you
> received this in error, please contact the sender and delete the e-mail
> and its attachments from all computers.
>
> ---------------------------------------------------------------------
> To start a new topic, e-mail: users@tomcat.apache.org
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
--
Peter Stavrinides
Albourne Partners (Cyprus) Ltd
Tel: +357 22 750652
If you are not an intended recipient of this e-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute it. Please visit http://www.albourne.com/email.html for important additional terms relating to this e-mail.
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Tomcat 5 and 6 Security advise
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Peter Stavrinides [mailto:p.stavrinides@albourne.com]
> Subject: Re: Tomcat 5 and 6 Security advise
>
> and nothing is mentioned about the benefits of
> running Apache with Tomcat for securing Tomcat
> in a purely Java environment
Adding layers generally doesn't improve security - it just provides
additional targets.
Some things to do:
1) Browse through the server.xml and web.xml settings in Tomcat's conf
directory, and disable anything you don't need, especially connectors.
2) Remove any uneeded webapps that come with Tomcat, such as the
examples, docs, and webdav.
3) Use a proper authentication Realm, not the toy default one that keeps
credentials in the tomcat-users.xml file.
4) Restrict access to Tomcat's file structure to a specific userid, and
run Tomcat with that userid.
I'm not aware of any security vulnerabilities in current Tomcat levels
other than the rather minor cross-scripting ones inherent in some of the
examples.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
MATERIAL and is thus for use only by the intended recipient. If you
received this in error, please contact the sender and delete the e-mail
and its attachments from all computers.
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat 5 and 6 Security advise
Posted by Peter Stavrinides <p....@albourne.com>.
It makes for interesting reading, however it was written for Tomcat 4...
how current is it?? and nothing is mentioned about the benefits of
running Apache with Tomcat for securing Tomcat in a purely Java
environment, please read the question Craig!
Craig Skinner wrote:
> On Thu, Jul 26, 2007 at 10:51:01AM +0300, Peter Stavrinides wrote:
>
>> Hi all,
>>
>> I need some advice with regards to Tomcat security,
>>
>
> http://www.oreilly.com/catalog/tomcat/chapter/ch06.pdf
>
>
> ---------------------------------------------------------------------
> To start a new topic, e-mail: users@tomcat.apache.org
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
--
Peter Stavrinides
Albourne Partners (Cyprus) Ltd
Tel: +357 22 750652
If you are not an intended recipient of this e-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute it. Please visit http://www.albourne.com/email.html for important additional terms relating to this e-mail.
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat 5 and 6 Security advise
Posted by Craig Skinner <cr...@kepax.co.uk>.
On Thu, Jul 26, 2007 at 10:51:01AM +0300, Peter Stavrinides wrote:
> Hi all,
>
> I need some advice with regards to Tomcat security,
http://www.oreilly.com/catalog/tomcat/chapter/ch06.pdf
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org