| 00:02.33 | jMCg | is currently reading Scalable Internet Architectures and thus thinking alot about alternatives... |
| 00:09.17 | jasonb | On Linux you can use either iptables or authbind to avoid running the Tomcat JVM as root, but still answer requests on port 80. |
| 00:10.58 | jMCg | So that's what I've been looking for. |
| 00:11.28 | jMCg | I've found setcap, but that's silly, as it's basically a capabilities(7) ``replace'' for sticky bits. |
| 00:15.35 | jasonb | setcap does not work with Sun's Hotspot JVM, sadly. I filed this bug about that, less than a week ago: http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6919633 |
| 00:16.14 | jasonb | jMCg: And, since Oracle just completed their Sun acquisition, they must have migrated Sun's web sites over to Weblogic now or something because that page takes forever to serve now! |
| 00:16.23 | jMCg | jasonb: privbind looks more promising -- also, neither privbind nor authbind are to be find on Fedora... |
| 00:16.42 | jMCg | jasonb: first day I tried it, it loaded faster! |
| 00:16.47 | jasonb | Right, I looked for a Fedora / RHEL authbind package, and there doesn't appear to be one. |
| 00:16.51 | jasonb | I didn't really look for privbind. |
| 00:17.21 | jMCg | yum search doesn't take much looking. |
| 00:17.48 | jMCg | puts it on his list of stuff to contribute to Fedora. |
| 00:20.18 | jasonb | I documented the iptables way in Tomcat: The Definitive Guide, 2nd Edition (O'Reilly), like over 2 years ago. |
| 00:21.01 | jMCg | Hrm. This is silly. According to the documentation (of privbind) there's still going to be a root process left running... |
| 00:24.27 | jasonb | But maybe it is a different process than the JVM process.. that would probably be okay. |
| 00:26.48 | jMCg | Still, the reason I've been looking for this (on Linux) is to not have anything start/run as root to begin with. |
| 00:27.01 | jMCg | The less runs as root, the happier I am. |
| 00:27.50 | jMCg | Anyway, I'm deviating from my original goal, which was to point a finger at the connectors-doc! |
| 00:32.52 | *** join/#tomcat acidjnk (i=acid@pD950A6BE.dip0.t-ipconnect.de) |
| 00:36.53 | *** join/#tomcat tess (n=tess@ppp-71-141-69-198.dsl.snfc21.pacbell.net) |
| 00:37.15 | *** join/#tomcat tess (n=tess@nat.800westelcamino.lindenlab.com) |
| 00:57.54 | jasonb | jMCg: I agree that the connector docs are a mess. I'm happy to say that I also don't do any proxying, especially since you lose half of your Tomcat's response performance if you do that! |
| 01:01.33 | *** join/#tomcat cofeineSunshine (n=justinas@kas.tavatievs.eu) |
| 01:09.48 | *** join/#tomcat Internat (n=nf@123-243-184-161.static.tpgi.com.au) |
| 01:38.43 | *** join/#tomcat crazy_imp (n=mj@a89-183-93-92.net-htp.de) |
| 01:39.38 | *** join/#tomcat jasonb (n=jasonb@m370536d0.tmodns.net) |
| 01:49.45 | *** join/#tomcat karstensrage (n=karstens@c-71-202-243-186.hsd1.ca.comcast.net) |
| 01:57.51 | *** join/#tomcat ohsix (i=ohsix@66.220.111.99) |
| 02:34.13 | *** join/#tomcat rku (n=wbfwib@179.Red-88-0-12.dynamicIP.rima-tde.net) |
| 02:48.56 | *** join/#tomcat none (n=km@adsl-76-254-15-253.dsl.pltn13.sbcglobal.net) |
| 02:50.54 | *** join/#tomcat gardleop1rd (n=gardleop@217.84-49-177.nextgentel.com) |
| 02:51.19 | *** join/#tomcat zerok (n=zerok@67-207-133-71.slicehost.net) [NETSPLIT VICTIM] |
| 02:51.36 | *** join/#tomcat acarbs12 (n=acarbone@173.9.89.1) |
| 02:55.24 | *** join/#tomcat jDX (n=james@67.110.142.99.ptr.us.xo.net) |
| 03:16.56 | *** join/#tomcat tess (n=tess@nat.800westelcamino.lindenlab.com) |
| 03:33.38 | *** join/#tomcat km (n=km@adsl-76-254-15-253.dsl.pltn13.sbcglobal.net) |
| 03:45.54 | *** join/#tomcat gkqv (n=eplwiavx@ip68-105-185-221.dc.dc.cox.net) |
| 05:03.54 | *** join/#tomcat nkewdlmmubta (n=qylbscax@76-14-221-140.or.wavecable.com) |
| 05:16.23 | *** join/#tomcat nstpzh (n=yqq@97-125-24-96.eugn.qwest.net) |
| 05:23.21 | *** join/#tomcat cbkqeswic (n=cyoute@c-68-32-120-142.hsd1.md.comcast.net) |
| 05:46.35 | *** join/#tomcat jasonb (n=jasonb@adsl-66-124-73-250.dsl.sntc01.pacbell.net) |
| 06:54.08 | *** join/#tomcat cct (n=iofohwlz@95-30-148-172.broadband.corbina.ru) |
| 06:56.09 | *** join/#tomcat dyh (n=zngqklci@c-71-229-212-103.hsd1.co.comcast.net) |
| 06:56.09 | *** join/#tomcat rfdvfbbeqo (n=rco@c-71-229-212-103.hsd1.co.comcast.net) |
| 07:05.04 | *** join/#tomcat ylv (n=bdnkdboe@cpe-174-102-102-80.woh.res.rr.com) |
| 07:06.41 | *** join/#tomcat zem (n=semqbr@c-24-21-20-21.hsd1.or.comcast.net) |
| 07:27.48 | *** join/#tomcat qoaiaygcktc (n=zwx@c-76-104-189-30.hsd1.wa.comcast.net) |
| 07:45.24 | *** join/#tomcat jasonb (n=jasonb@adsl-66-124-73-250.dsl.sntc01.pacbell.net) |
| 08:11.23 | *** join/#tomcat phrozen77 (i=phrozen7@unaffiliated/phrozen77) |