[Bug 60547] Tomcat Configuration

2017-01-03 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=60547 --- Comment #4 from Lan --- thank you so much for the quick response. I really appreciate your time and supports. -- You are receiving this mail because: You are the assignee for the bug. -

[Bug 60547] Tomcat Configuration

2017-01-03 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=60547 --- Comment #3 from Christopher Schultz --- Join the (email) mailing list and send a message to it. http://tomcat.apache.org/lists.html You want the "tomcat-users" mailing list. -- You are receiving this mail because: You are the assignee f

[Bug 60547] Tomcat Configuration

2017-01-03 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=60547 --- Comment #2 from Lan --- can you tell me how I submit this question to the users' mailing list? Thank you. -- You are receiving this mail because: You are the assignee for the bug.

[Bug 60547] Tomcat Configuration

2017-01-03 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=60547 Christopher Schultz changed: What|Removed |Added Resolution|--- |INVALID Status|NEW

[Bug 60547] New: Tomcat Configuration

2017-01-03 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=60547 Bug ID: 60547 Summary: Tomcat Configuration Product: Tomcat 7 Version: 7.0.65 Hardware: PC Status: NEW Severity: normal Priority: P2 Component

Re: Tomcat Configuration Hardening

2016-03-07 Thread Rémy Maucherat
2016-03-07 17:52 GMT+01:00 Mark Thomas : > On 05/03/2016 18:36, Mark Thomas wrote: > > On 05/03/2016 17:08, Christopher Schultz wrote: > > > >>> First of all we could add the remote address valve and limit access to > >>> localhost by default. That will limit some remote attacks but possibly > >>>

Re: Tomcat Configuration Hardening

2016-03-07 Thread Mark Thomas
On 05/03/2016 18:36, Mark Thomas wrote: > On 05/03/2016 17:08, Christopher Schultz wrote: > >>> First of all we could add the remote address valve and limit access to >>> localhost by default. That will limit some remote attacks but possibly >>> not all depending on reverse proxy configurations >>

Re: Tomcat Configuration Hardening

2016-03-05 Thread Mark Thomas
On 05/03/2016 17:08, Christopher Schultz wrote: >> First of all we could add the remote address valve and limit access to >> localhost by default. That will limit some remote attacks but possibly >> not all depending on reverse proxy configurations > > I was thinking about this as well. It would

Re: Tomcat Configuration Hardening

2016-03-05 Thread Christopher Schultz
Mark, On 3/3/16 3:35 PM, Mark Thomas wrote: > On 03/03/2016 15:36, Christopher Schultz wrote: >> Dylan, >> >> This might be a better discussion for the users' list, but I'll keep it >> on dev for the time being. >> >> On 2/28/16 2:28 PM, Dylan Ayrey wrote: >>> I'm a security analyst at a company n

Re: Tomcat Configuration Hardening

2016-03-03 Thread Emmanuel Bourg
Le 3/03/2016 16:36, Christopher Schultz a écrit : > 2. Many people use OS-package-managed versions of Tomcat, and we have no > control over what goes on, there. Whatever we may do may be undone by > the package manager(s). FWIW I'm in a position to change the packaging of Tomcat in Debian (and in

Re: Tomcat Configuration Hardening

2016-03-03 Thread Mark Thomas
On 03/03/2016 15:36, Christopher Schultz wrote: > Dylan, > > This might be a better discussion for the users' list, but I'll keep it > on dev for the time being. > > On 2/28/16 2:28 PM, Dylan Ayrey wrote: >> I'm a security analyst at a company named Praetorian. When doing internal >> network pent

Re: Tomcat Configuration Hardening

2016-03-03 Thread Christopher Schultz
Dylan, This might be a better discussion for the users' list, but I'll keep it on dev for the time being. On 2/28/16 2:28 PM, Dylan Ayrey wrote: > I'm a security analyst at a company named Praetorian. When doing internal > network pentesting it is extremely common to find tomcat instances with >

Tomcat Configuration Hardening

2016-02-28 Thread Dylan Ayrey
To whom it may concern, I'm a security analyst at a company named Praetorian. When doing internal network pentesting it is extremely common to find tomcat instances with manager portals, and users added to the manager role with the credentials on line 35 of this file *http://svn.apache.org/repos/a

DO NOT REPLY [Bug 40222] Default Tomcat configuration alows easy session hijacking

2010-08-25 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=40222 Mark Thomas changed: What|Removed |Added Status|NEEDINFO|RESOLVED Resolution|

DO NOT REPLY [Bug 42593] - Win32 Apache/jk/tomcat configuration causes 100% cpu usage

2007-11-14 Thread bugzilla
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG· RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT . ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND· INSERTED IN THE BUG DATABASE. http://issues.apache.org/bugzilla/show_bu

DO NOT REPLY [Bug 42593] - Win32 Apache/jk/tomcat configuration causes 100% cpu usage

2007-11-13 Thread bugzilla
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG· RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT . ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND· INSERTED IN THE BUG DATABASE. http://issues.apache.org/bugzilla/show_bu

DO NOT REPLY [Bug 42593] - Win32 Apache/jk/tomcat configuration causes 100% cpu usage

2007-06-14 Thread bugzilla
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG· RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT . ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND· INSERTED IN THE BUG DATABASE. http://issues.apache.org/bugzilla/show_bu

DO NOT REPLY [Bug 42593] New: - Win32 Apache/jk/tomcat configuration causes 100% cpu usage

2007-06-05 Thread bugzilla
gzilla/show_bug.cgi?id=42593 Summary: Win32 Apache/jk/tomcat configuration causes 100% cpu usage Product: Tomcat 5 Version: 5.5.23 Platform: Other OS/Version: Windows XP Status: NEW Severity: critical Pr

Re: Tomcat Configuration.

2007-04-09 Thread Mark Thomas
Abhinay Kartik Reddyreddy wrote: > Hi, > > I am working on web-services(jaxrpc) and trying to set up the tomcat server > so that the server processes only two requests concurrently, the third > request should be dropped if it occurs at the time of processing the first 2 > requests. > how do i con

Tomcat Configuration.

2007-04-09 Thread Abhinay Kartik Reddyreddy
. Tganks and regards, kartik. -- View this message in context: http://www.nabble.com/Tomcat-Configuration.-tf3546741.html#a9900722 Sent from the Tomcat - Dev mailing list archive at Nabble.com. - To unsubscribe, e-mail: [EMAIL

DO NOT REPLY [Bug 40222] - Default Tomcat configuration alows easy session hijacking

2007-01-23 Thread bugzilla
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG· RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT . ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND· INSERTED IN THE BUG DATABASE. http://issues.apache.org/bugzilla/show_bu

DO NOT REPLY [Bug 40222] - Default Tomcat configuration alows easy session hijacking

2007-01-20 Thread bugzilla
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG· RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT . ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND· INSERTED IN THE BUG DATABASE. http://issues.apache.org/bugzilla/show_bu

DO NOT REPLY [Bug 40222] - Default Tomcat configuration alows easy session hijacking

2007-01-12 Thread bugzilla
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG· RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT . ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND· INSERTED IN THE BUG DATABASE. http://issues.apache.org/bugzilla/show_bu

DO NOT REPLY [Bug 40222] - Default Tomcat configuration alows easy session hijacking

2007-01-12 Thread bugzilla
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG· RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT . ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND· INSERTED IN THE BUG DATABASE. http://issues.apache.org/bugzilla/show_bu

DO NOT REPLY [Bug 40222] - Default Tomcat configuration alows easy session hijacking

2007-01-11 Thread bugzilla
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG· RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT . ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND· INSERTED IN THE BUG DATABASE. http://issues.apache.org/bugzilla/show_bu

DO NOT REPLY [Bug 40222] - Default Tomcat configuration alows easy session hijacking

2006-12-26 Thread bugzilla
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG· RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT . ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND· INSERTED IN THE BUG DATABASE. http://issues.apache.org/bugzilla/show_bu

DO NOT REPLY [Bug 40222] - Default Tomcat configuration alows easy session hijacking

2006-12-26 Thread bugzilla
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG· RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT . ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND· INSERTED IN THE BUG DATABASE. http://issues.apache.org/bugzilla/show_bu

DO NOT REPLY [Bug 40222] New: - Default Tomcat configuration alows easy session hijacking

2006-08-09 Thread bugzilla
gzilla/show_bug.cgi?id=40222 Summary: Default Tomcat configuration alows easy session hijacking Product: Tomcat 5 Version: 5.0.15 Platform: All OS/Version: All Status: NEW Severity: major Priori