You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@tomcat.apache.org by Jorge Medina <ce...@gmail.com> on 2011/03/02 04:07:04 UTC

Re: [OT] Memory Leak in Tomcat

I got a good laugh with your message.

Security seems to be always in the hands of the wrong people.

Once I asked for the algorithm used to hash the passwords (that
happened to be HMAC SHA-1) into a database, if I was going to
authenticate the users, I needed to use the same algorithm. I did not
ask for the key used to salt the hash, I could put that as a parameter
to be provided at install time and use any other key during
development and testing. My request was rejected until authorized by a
manager two levels up!  <sigh> (All I needed to know was "HMAC
SHA-1"!)




On Mon, Feb 28, 2011 at 11:02 AM, Christopher Schultz
<ch...@christopherschultz.net> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> הילה,
>
> On 2/28/2011 5:17 AM, הילה wrote:
>> How can I encrypt the password inside the xml file?
>
> 0. $file = conf/server.xml
> 1. Use your favorite encryption tool to encrypt the password and shove
>   it into $file
> 2. Use that same tool in some code you hack-into Tomcat to read it
>   back out.
> 3. Store the key to your favorite-tool encryption package in another
>   file (say, s3cr3t.key)
> 4. $file = s3cr3t.key
> 5. Go to step 1.
>
> Repeat this process until you feel like you're safe. (Hint: you are
> still not safe). Scratch that: repeat this process until your boss or
> your auditor feel like they are safe.
>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk1rxwwACgkQ9CaO5/Lv0PCtGQCgtxVxV9+N0AvRuYw0U6mi9ki1
> ikgAn1xQNqRRtSKby531xKRHizxzEFwD
> =uuFd
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: tomcat server

Posted by Jeff Hubbs <jh...@att.net>.

If you use "localhost2" as a URL, you will almost certainly get an error 
because that name is unlikely to resolve to a system that is set up to 
provide a Web service to your browser.  If you get an error when using 
the URL "localhost", that is because the machine you're running that 
browser on ("localhost", by convention, always refers to the machine on 
which the network host reference is being made) does not have a Web 
service configured to respond on IP port 80, which, also by convention, 
is the default port number for http traffic.  It works when you use 
"localhost:8080" because 8080 is the default IP port on which Tomcat 
receives Web traffic.  So, your arrangement is working exactly as one 
would expect.

On 3/10/11 12:36 PM, ken dias wrote:
> Questions:1. how to get response (not error)  when i type localhost2. why does it work in one case and not the other
> please don't try to be funny, answer the question or don't reply
>
>> From: Chuck.Caldarale@unisys.com
>> To: users@tomcat.apache.org
>> Date: Thu, 10 Mar 2011 11:16:38 -0600
>> Subject: RE: tomcat server
>>
>>> From: ken dias [mailto:kendias@hotmail.com]
>>> Subject: tomcat server
>>> I started the Tomcat webserver. When I keyin "localhost:8080",
>>> I get the apache-tomcat webpage and can run the examples.
>>> however, when i keyin "localhost"  only, i get error.
>> As you should.  Do you have a question?
>>
>>   - Chuck
>>
>>
>> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>   		 	   		

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Memory Leak in Tomcat

Posted by הילה <hi...@gmail.com>.

Hey,
i've posted a message on JTDS forums, but no one answered.

I know the memory leak is caused by the dll, since when I don't use it, all
is good.
i'll open a new thread here, thanks


2011/3/6 André Warnier <aw...@ice-sa.com>

> הילה wrote:
>
>> Security seems to be always in the hands of the wrong people.
>>
>> No need for insults here, this is a new requirement which I'm not familiar
>> with, and that's why I asked you guys..
>>
>>
>> Instead of the JTDS, can I use Tomcat Spengo?
>> will it provide same results, as using a domain user for the tomcat
>> windows
>> service, and removing user and password from xml configuration file under
>> conf/catalina/localhost ?
>>
>>
> Maybe it is time to "rewind", and restart from the beginning, before the
> thread degenerated into a discussion about the comparative aspects of
> security etc..
>
> I gather that by now, you must have established that the memory leak was
> not in Tomcat per se, but in the jDTS/jTDS driver, and/or the .dll that it
> is using for Windows-based authentication, right ?
>
> If so, maybe you want start another new thread, with a more appropriate
> subject ?
> (If so, do not hit "reply", start a new message to the list)
>
> Also, did you ever ask the jDTS/jTDS people about this memory leak, and did
> you ever get an answer ?
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>

Re: Memory Leak in Tomcat

Posted by André Warnier <aw...@ice-sa.com>.

הילה wrote:
> Security seems to be always in the hands of the wrong people.
> 
> No need for insults here, this is a new requirement which I'm not familiar
> with, and that's why I asked you guys..
> 
> 
> Instead of the JTDS, can I use Tomcat Spengo?
> will it provide same results, as using a domain user for the tomcat windows
> service, and removing user and password from xml configuration file under
> conf/catalina/localhost ?
> 

Maybe it is time to "rewind", and restart from the beginning, before the thread 
degenerated into a discussion about the comparative aspects of security etc..

I gather that by now, you must have established that the memory leak was not in Tomcat per 
se, but in the jDTS/jTDS driver, and/or the .dll that it is using for Windows-based 
authentication, right ?

If so, maybe you want start another new thread, with a more appropriate subject ?
(If so, do not hit "reply", start a new message to the list)

Also, did you ever ask the jDTS/jTDS people about this memory leak, and did you ever get 
an answer ?

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

RE: tomcat server

Posted by ken dias <ke...@hotmail.com>.

thanks for a clear answer.
Ken

> Date: Thu, 10 Mar 2011 12:41:06 -0500
> Subject: Re: tomcat server
> From: jr@tabbysplace.org
> To: users@tomcat.apache.org
> 
> When you enter localhost:8080 the browser treis to speak to a server
> on port 8080, where Tomcat runs by default.
> 
> When you just enter localhost, the browser uses the default HTTP port
> of 80.  Presumably, you do not have a server listening to that port.
> 
> Make sense?
> 
> --
> Jonathan Rosenberg
> Founder & Executive Director
> Tabby's Place, a Cat Sanctuary
> http://www.tabbysplace.org/
> 
> 
> On Thu, Mar 10, 2011 at 12:36 PM, ken dias <ke...@hotmail.com> wrote:
> >
> > Questions:1. how to get response (not error)  when i type localhost2. why does it work in one case and not the other
> > please don't try to be funny, answer the question or don't reply
> >
> >> From: Chuck.Caldarale@unisys.com
> >> To: users@tomcat.apache.org
> >> Date: Thu, 10 Mar 2011 11:16:38 -0600
> >> Subject: RE: tomcat server
> >>
> >> > From: ken dias [mailto:kendias@hotmail.com]
> >> > Subject: tomcat server
> >>
> >> > I started the Tomcat webserver. When I keyin "localhost:8080",
> >> > I get the apache-tomcat webpage and can run the examples.
> >> > however, when i keyin "localhost"  only, i get error.
> >>
> >> As you should.  Do you have a question?
> >>
> >>  - Chuck
> >>
> >>
> >> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
> >>
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> >> For additional commands, e-mail: users-help@tomcat.apache.org
> >>
> >
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>

Re: tomcat server

Posted by Jonathan Rosenberg <jr...@tabbysplace.org>.

When you enter localhost:8080 the browser treis to speak to a server
on port 8080, where Tomcat runs by default.

When you just enter localhost, the browser uses the default HTTP port
of 80.  Presumably, you do not have a server listening to that port.

Make sense?

--
Jonathan Rosenberg
Founder & Executive Director
Tabby's Place, a Cat Sanctuary
http://www.tabbysplace.org/


On Thu, Mar 10, 2011 at 12:36 PM, ken dias <ke...@hotmail.com> wrote:
>
> Questions:1. how to get response (not error)  when i type localhost2. why does it work in one case and not the other
> please don't try to be funny, answer the question or don't reply
>
>> From: Chuck.Caldarale@unisys.com
>> To: users@tomcat.apache.org
>> Date: Thu, 10 Mar 2011 11:16:38 -0600
>> Subject: RE: tomcat server
>>
>> > From: ken dias [mailto:kendias@hotmail.com]
>> > Subject: tomcat server
>>
>> > I started the Tomcat webserver. When I keyin "localhost:8080",
>> > I get the apache-tomcat webpage and can run the examples.
>> > however, when i keyin "localhost"  only, i get error.
>>
>> As you should.  Do you have a question?
>>
>>  - Chuck
>>
>>
>> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

RE: tomcat server

Posted by ken dias <ke...@hotmail.com>.

Questions:1. how to get response (not error)  when i type localhost2. why does it work in one case and not the other
please don't try to be funny, answer the question or don't reply

> From: Chuck.Caldarale@unisys.com
> To: users@tomcat.apache.org
> Date: Thu, 10 Mar 2011 11:16:38 -0600
> Subject: RE: tomcat server
> 
> > From: ken dias [mailto:kendias@hotmail.com] 
> > Subject: tomcat server
> 
> > I started the Tomcat webserver. When I keyin "localhost:8080",
> > I get the apache-tomcat webpage and can run the examples.
> > however, when i keyin "localhost"  only, i get error.
> 
> As you should.  Do you have a question?
> 
>  - Chuck
> 
> 
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>

RE: tomcat server

Posted by "Caldarale, Charles R" <Ch...@unisys.com>.

> From: ken dias [mailto:kendias@hotmail.com] 
> Subject: tomcat server

> I started the Tomcat webserver. When I keyin "localhost:8080",
> I get the apache-tomcat webpage and can run the examples.
> however, when i keyin "localhost"  only, i get error.

As you should.  Do you have a question?

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: tomcat server

Posted by David Smith <da...@cornell.edu>.

Perfectly normal .... browsers assume port 80 when you don't offer a
port number in the url.  Your tomcat instance is not listening on port
80 and won't be able to respond when you try to access it there.

Solution: change the port number in your tomcat's server.xml file and
restart.

--David

On 3/10/2011 12:13 PM, ken dias wrote:
>
>  
> I started the Tomcat webserver. When I keyin "localhost:8080", I get the apache-tomcat webpage and can run the examples. however, when i keyin "localhost"  only, i get error.
>  
> Thanks,
> Ken
>  		 	   		  

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

tomcat server

Posted by ken dias <ke...@hotmail.com>.


 
I started the Tomcat webserver. When I keyin "localhost:8080", I get the apache-tomcat webpage and can run the examples. however, when i keyin "localhost"  only, i get error.
 
Thanks,
Ken