| 00:07.22 | *** join/#tomcat aniasis (i=jiggyhoo@cpe-70-123-126-122.tx.res.rr.com) |
| 01:03.02 | *** part/#tomcat magmarules (n=magmarul@89-180-48-173.net.novis.pt) |
| 01:04.44 | *** join/#tomcat jasonb (n=jasonb@75-144-23-117-SFBACA.hfc.comcastbusiness.net) |
| 01:52.16 | *** join/#tomcat haxplorer (n=haxplore@122.167.183.214) |
| 03:13.42 | *** join/#tomcat haxplorer (n=haxplore@nat/yahoo/x-96c1e793bac5f7e4) |
| 03:31.33 | perr0 | alright jasonb I got the BadInputFilter working |
| 03:32.24 | jasonb | perr0: Congratulations! |
| 03:32.45 | perr0 | man I don't claim to be the smartest man in the world but finally just had to adjust the example from the book to the directories on my box |
| 03:32.45 | jasonb | perr0: Seems to function as described? |
| 03:32.49 | *** join/#tomcat huhlig (n=Hans@c-76-102-243-184.hsd1.ca.comcast.net) |
| 03:33.32 | huhlig | question, is something strange with 6.0.20-win32 none of my webapps seem to be found including examples and manager |
| 03:33.41 | huhlig | everything throws a 404 |
| 03:34.29 | perr0 | when I edited my web.xml I edited to match the book example at the <filter-class></filter-class> |
| 03:36.08 | perr0 | and in the book I understood that I was suppose to use Tomcat's jars. Instead this time when I compiled the filter I used the jars that came with the badinputfilter |
| 03:36.17 | perr0 | I am a little slow |
| 03:38.23 | huhlig | ..? |
| 03:39.49 | jasonb | perr0: At least you figured it out. :) |
| 03:40.27 | huhlig | is there anyway to turn up logging so I can catch some form of error? |
| 03:41.32 | perr0 | yes, so tomorrow I am going to make our dev team add it to our app for further testing. what is your opinion on using the jsvc daemon to run tomcat as non-root? |
| 03:41.57 | jasonb | perr0: My suggestion is to use iptables to remap 80 to 8080. |
| 03:42.43 | jasonb | perr0: Tomcat itself is multiplatform software, but jsvc and other native wrappers are not.. they're architecture specific. Plus, they are software and they have their own bugs, and those bugs have been known to make Tomcat fail. |
| 03:43.08 | perr0 | ok |
| 03:43.27 | perr0 | we run our apps on 445 |
| 03:43.45 | *** join/#tomcat barkbarkmeow (n=barkbark@g224152101.adsl.alicedsl.de) |
| 03:44.22 | jasonb | Some don't like iptables, and I can understand because iptables takes some brain power to figure out and get used to. But, after spending a little time with it, and running Tomcat that way, and after trying jsvc and JavaServiceWrapper, I much prefer the iptables solution. |
| 03:46.39 | perr0 | I use iptables personally but that will be another pandora's box with out dev team |
| 03:47.20 | perr0 | our* |
| 03:52.55 | huhlig | sigh |
| 03:52.59 | huhlig | nothing exists to tomcat |
| 04:20.49 | *** join/#tomcat Alterscapes (n=ryanspic@ip68-0-173-217.tc.ph.cox.net) |
| 04:50.30 | *** join/#tomcat karstensrage (n=karstens@c-76-103-32-139.hsd1.ca.comcast.net) |
| 05:14.26 | *** join/#tomcat jasonb (n=jasonb@adsl-66-124-73-250.dsl.sntc01.pacbell.net) |
| 05:37.29 | *** join/#tomcat internat1 (n=nf@123-243-184-161.static.tpgi.com.au) |
| 05:38.53 | *** join/#tomcat shashi_ (n=shashi@122.181.1.158) |
| 06:07.28 | *** join/#tomcat apelW (n=metaltux@62.209.163.98) |
| 07:26.43 | *** join/#tomcat loddafnir (n=mike@at-vie-gaso-r11a.upc.at) |
| 07:45.17 | *** join/#tomcat makronaut_ (n=quassel@89-212-5-254.static.t-2.net) |
| 07:46.11 | *** join/#tomcat kjkoster5489 (n=kjkoster@62-102-103-145.static.glaslokaal.nl) |
| 08:17.40 | *** join/#tomcat odin__ (n=dlm@host86-128-149-45.range86-128.btcentralplus.com) [NETSPLIT VICTIM] |
| 08:25.16 | *** join/#tomcat trifon (n=chatzill@p54918B9E.dip0.t-ipconnect.de) |
| 08:37.03 | *** join/#tomcat kjkoster5489 (n=kjkoster@62-102-103-145.static.glaslokaal.nl) |
| 08:55.02 | *** join/#tomcat magentar (n=magentar@94.79.143.94) |
| 09:33.40 | *** join/#tomcat kjkoster5489 (n=kjkoster@233-250-103-145.static.glaslokaal.nl) |
| 09:37.52 | *** join/#tomcat mcahornsirup (n=mcahorns@static-87-79-71-74.netcologne.de) |
| 09:44.02 | *** join/#tomcat apelW (n=metaltux@62.209.163.98) |
| 09:55.58 | *** join/#tomcat magentar (n=magentar@94.79.143.94) |
| 10:06.05 | *** join/#tomcat shashi__ (n=shashi@122.181.1.158) |
| 10:33.53 | *** join/#tomcat haxplorer (n=haxplore@nat/yahoo/x-b430cac9e832eab5) |
| 11:03.12 | *** join/#tomcat jorisslob (n=jslob@132.229.129.197) |
| 12:12.53 | *** part/#tomcat jorisslob (n=jslob@132.229.129.197) |
| 12:41.38 | *** join/#tomcat randrew (n=raj@dyn-128-59-53-15.dyn.columbia.edu) |
| 13:09.28 | *** join/#tomcat dvayanu (n=another@host-62-245-224-138.customer.m-online.net) |
| 13:26.33 | *** join/#tomcat benn_d (n=benn_d@c-67-176-147-20.hsd1.in.comcast.net) |
| 14:06.02 | *** join/#tomcat randrew (n=raj@dyn-128-59-53-15.dyn.columbia.edu) [NETSPLIT VICTIM] |
| 14:06.02 | *** join/#tomcat ohsix (i=ohsix@66.220.111.99) [NETSPLIT VICTIM] |
| 14:10.35 | *** join/#tomcat Alterscapes (n=ryanspic@68.0.173.217) |
| 14:48.31 | *** join/#tomcat Rrr (n=lisa@flatline.de) |
| 14:48.34 | Rrr | hello |
| 14:48.48 | kjkoster5489 | hi |
| 14:57.56 | *** join/#tomcat Sitting_wolf (n=jesus@vpn01-sm-72.unifr.ch) |
| 14:59.33 | *** join/#tomcat dorimar (n=quassel@32.97.110.59) |
| 14:59.54 | Rrr | hmmm |
| 15:34.22 | Sitting_wolf | Hello, just a small question i have deployed a webservice on tomcat through netbeans and access it through the network, somehow it parses all my special chars like "<" ">" as "&lgt;" did. could that be a tomcat problem? |
| 15:57.25 | *** join/#tomcat miah (n=miah@63.231.253.190) |
| 15:58.42 | *** join/#tomcat mcahornsirup___ (n=mcahorns@static-87-79-71-74.netcologne.de) |
| 15:59.29 | miah | tomcat: 5.5.23, java: 1.4.2, centos: 5.3. I am new to tomcat. I am looking to install it on a new server so we can ditch an old one. However, all the pages on port 80 show jsp with the <% tags and nothing loads on port 8080 at all. Firewall is open to both ports. I have followed three guides with no further progress on this matter. Any assistance would be appreciated. |
| 16:18.39 | *** join/#tomcat azlev (n=ze@200.234.206.72) |
| 16:35.03 | *** join/#tomcat kml (n=unknown@adsl-99-54-8-188.dsl.pltn13.sbcglobal.net) |
| 16:37.50 | miah | I've also run a port scanner and found it was not listening on 8080 and I don't know how to make it. I set CONNECTOR_PORT=8080 for it |
| 16:39.34 | miah | 8180 somehow is open though it loads nothing but a blank page |
| 16:39.43 | miah | 8180/tcp open http Apache Tomcat/Coyote JSP engine 1.1 |
| 16:47.04 | *** join/#tomcat pucko (n=andreas@h19n2fls304o253.telia.com) |
| 16:53.50 | Alterscapes | tomcat: 6.0.20, java 1.6.0_13, Ubuntu 8.04. Using Apache2.2 + mod_proxy_ajp to reverse-proxy tomcat through Apache2. I have the proxy set up to map <Location /tomcat> to the root of Tomcat. Problem is, all the URLs in the returned pages point to / as the root of the tomcat structure. I'm trying to use mod_proxy_html to correct this using the following directive inside my <Location> tag: "ProxyHTMLURLMap / /tomcat" .. but no joy. Thoughts? |
| 17:05.55 | *** join/#tomcat jasonb (n=jasonb@75-144-23-117-SFBACA.hfc.comcastbusiness.net) |
| 18:02.59 | *** join/#tomcat kjkoster5489 (n=kjkoster@kjkoster.org) |
| 18:34.54 | kml | any suggestions how i can secure the tomcat shutdown port? |
| 18:35.13 | randrew | kml: limit it to host 127.0.0.1 |
| 18:35.40 | kml | other than using firewal for public accessable system and change the shutdown command |
| 18:36.06 | kml | what you mean by 127.0.0.1 like how? |
| 18:36.12 | kjkoster5489 | Also make the server.xml unreadable for the people you don't want to shut down time. |
| 18:36.20 | kml | yes |
| 18:36.24 | kml | i did that |
| 18:36.42 | kml | are there other option available |
| 18:37.00 | kjkoster5489 | Check with netstat that port 8005 is only bound to 127.0.0.1 and not to *. |
| 18:37.14 | kjkoster5489 | Are people shutting down your tomcat servers? |
| 18:37.17 | kml | 127.0.0.1? i thought shutdown is only to the system (localhost)? |
| 18:37.47 | kjkoster5489 | 127.0.0.1 == localhost. |
| 18:37.55 | kml | no, just want to enforce security |
| 18:38.00 | kml | right |
| 18:38.49 | kjkoster5489 | *shrug* Don't solve problems you don't actually have. :) |
| 18:38.52 | kml | so why some suggest limit to 127.0.0.1 is that is the default |
| 18:39.26 | kjkoster5489 | Some distro's futz with the defaults. |
| 18:39.27 | randrew | kml: nm, it used to not be default. |
| 18:39.42 | kml | what was it use to be than? |
| 18:39.50 | kml | on what verions? |
| 18:40.59 | kml | if that is the default where you check to make it set/bind to 127.0.0.1? |
| 18:41.47 | kml | isn't shudtdown commands can only come from the local tomcat and not the external source? |
| 18:42.25 | kml | if i am not mistaken on what i have read about tomcat shutdown |
| 18:43.56 | kml | is a tomcat user thread discussion about code customization as alternative to secure the shutdown port, but it unclear to me. |
| 18:43.58 | randrew | kml: nm, shutdown has been localhost for a long while.(I was thinking of the connectors where you can specify an address.) |
| 18:44.08 | kml | ok |
| 18:44.09 | kjkoster5489 | kml: use netstat |
| 18:45.16 | kml | iam looking for other alternatives to secure shutdown port other than i have mentioned here, any suggestions? |
| 18:46.06 | kml | anyone awares if there are any future plans to enhance tomcat shutdown port? |
| 18:47.24 | kjkoster5489 | You're done. You know more about Tomcat's shutdown port than anyone would ever care to know. |
| 18:47.34 | kjkoster5489 | Sorry. |
| 18:49.24 | kml | i just seeking way to enhance local tomcat security issue. sorry, maybe i am be i just too paraniod about security. |
| 18:49.45 | kml | i am just seeking ways ... |
| 18:50.44 | kjkoster5489 | Well, people shutting down your Tomcat is the least of your worries. |
| 18:50.48 | kjkoster5489 | You will notice. |
| 18:50.55 | kml | it seem like most people don't really care shutdown port issue. |
| 18:51.06 | kjkoster5489 | Well, I firewall it off and leave it/ |
| 18:51.26 | kml | ok ;) |
| 18:51.33 | kjkoster5489 | And it is not an issue, except on university shared machines where classmates shut down eachother's Tomcats. |
| 18:52.43 | kml | i just having a hardtime trusting user/people include friends. |
| 18:52.56 | kml | but that just me |
| 18:54.37 | kjkoster5489 | Check out slowloris. |
| 18:54.41 | kml | i remember there was time that people have access to my system was playing tricks on me (giving hardtime) |
| 18:54.48 | kjkoster5489 | Now that is a problem you might actually have. |
| 18:55.35 | kjkoster5489 | Then improve your monitoring system to 1) alert you of odd activity, 2) tell you who has access at that time and 3) auto-orders a cluebat for you to wield on them. |
| 18:57.33 | kml | yes, and this part of security enhancement iam looking to improve on.. |
| 18:59.11 | *** part/#tomcat Rrr (n=lisa@flatline.de) |
| 19:02.10 | kml | btw, is there get around using address supply by VIP instead of the localhost for the shutdown port? |
| 19:02.42 | kml | is there a way to get around... |
| 19:07.57 | *** join/#tomcat karstensrage (n=chatzill@70.42.238.2) |
| 19:08.33 | kml | would this be the right place make the change? <Engine name="Standalone" defaultHost="localhost" debug="0"> |
| 19:11.43 | *** join/#tomcat karstensrage (n=chatzill@70.42.238.2) |
| 19:22.19 | *** join/#tomcat BarryNL (n=goltharn@82-95-227-51.xs4all.nl) |
| 19:50.07 | *** join/#tomcat azlev (n=ze@200.234.206.72) |
| 19:57.41 | kml | randew, tomcat is bind to 127.0.0.1, any ideas where i can change this bind address? i tried modify the server.xml localhost but that didn't seem to work. |
| 20:06.14 | *** join/#tomcat MHSL (i=Linux@cm15.eta6.maxonline.com.sg) |
| 20:21.51 | *** join/#tomcat rightsprocket (n=mrray@c-68-63-24-189.hsd1.fl.comcast.net) |
| 20:38.17 | *** join/#tomcat mcahornsirup__ (n=mcahorns@static-87-79-71-74.netcologne.de) |
| 20:49.33 | *** join/#tomcat MHSL- (i=Linux@cm15.eta6.maxonline.com.sg) |
| 21:10.56 | *** join/#tomcat epalm (n=epalm@utl-192-234.library.utoronto.ca) |
| 21:12.27 | epalm | i'm passing an arraylist of objects to jsp, but inside <c:forEach items="${vars}" var="var">, ${var.blah} crashes with "javax.el.PropertyNotFoundException: Property 'name' not readable on type java.lang.String |
| 21:12.27 | epalm | " |
| 21:15.28 | epalm | ${var.name} rather |
| 21:15.35 | epalm | why does it think var is a string |
| 22:42.15 | *** join/#tomcat noah1 (n=nlevitt@c-67-170-223-242.hsd1.ca.comcast.net) |
| 22:54.46 | km | does anyone know how i can modify the tomcat shutdown port localhost binding address to some other address? |
| 23:00.52 | noah1 | km: i don't think you can |
| 23:14.11 | km | i try to prevent people from telneting to localhost shutdown port and issue unwanted shutdown. |
| 23:14.31 | km | that doesn't sound good |
| 23:16.44 | *** join/#tomcat dvayanu (n=another@ppp-62-216-217-55.dynamic.mnet-online.de) |
| 23:38.51 | *** join/#tomcat blurt (n=trulb@unaffiliated/gbauman) |
| 23:40.45 | blurt | Is there a "proper" way to package up catalina security policies required by a .war, or is it required to simply make the changes to each server instance I deploy the war to? |
| 23:56.09 | noah1 | km: you can only connect to localhost from localhost |
| 23:56.27 | noah1 | km: that's the reason you're not allowed to set that address |