Re: Tomcat-Lite update

2009-11-07 Thread Henri Gomez
And what about some sort of OSGI glue and Maven as build tool ? 2009/11/6 Costin Manolache : > On Fri, Nov 6, 2009 at 12:19 PM, Tim Funk wrote: > >> I am intrigued by the idea and have similar constraints (kids+job). >> >> My longer term interest in lite was a simpler deployment and moving config

DO NOT REPLY [Bug 48157] New: describe how to disable X-Header trick to attack client cert auth

2009-11-07 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=48157 Summary: describe how to disable X-Header trick to attack client cert auth Product: Tomcat 5 Version: Unknown Platform: All OS/Version: All Status: NEW

DO NOT REPLY [Bug 48158] New: warn that "per directory client certificate authentication" is harmful

2009-11-07 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=48158 Summary: warn that "per directory client certificate authentication" is harmful Product: Tomcat 5 Version: Unknown Platform: All OS/Version: All Status: NEW

DO NOT REPLY [Bug 48157] describe how to disable X-Header trick to attack client cert auth

2009-11-07 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=48157 --- Comment #1 from Ralf Hauser 2009-11-07 08:09:41 UTC --- see also Bug 48158 -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for

DO NOT REPLY [Bug 34643] document how to use certificate-based "clientAuth" on a per user or per session basis also with self-signed/expired client certs

2009-11-07 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=34643 --- Comment #11 from Ralf Hauser 2009-11-07 08:09:50 UTC --- see also Bug 48157 and Bug 48158 -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are th

Re: Tomcat-Lite update

2009-11-07 Thread Costin Manolache
On Sat, Nov 7, 2009 at 1:25 AM, Henri Gomez wrote: > And what about some sort of OSGI glue Thanks for volunteering :-). Note that my goal is to _remove_ any framework feature from tomcat-lite - leave just http and services, no config file or class loading. The current 'integration' interface se

SSL & Tomcat

2009-11-07 Thread Mark Thomas
All, I was thinking about this on my way back from ApacheCon and we probably need to get some advice out to users early next week. My current understanding is that the MITM attack is triggered by a renegotiation. On this basis I suggest something along the following lines: SSL using JSSE (BIO a

DO NOT REPLY [Bug 48157] describe how to disable X-Header trick to attack client cert auth

2009-11-07 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=48157 Mark Thomas changed: What|Removed |Added Status|NEW |RESOLVED Resolution|

DO NOT REPLY [Bug 48158] warn that "per directory client certificate authentication" is harmful

2009-11-07 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=48158 --- Comment #1 from Mark Thomas 2009-11-07 09:10:34 GMT --- Agreed the warning needs to go out although the docs aren't the best place for it. Please join the discussion on the dev list. -- Configure bugmail: https://issues.apache.org/bug

Re: SSL & Tomcat

2009-11-07 Thread Costin Manolache
On Sat, Nov 7, 2009 at 8:59 AM, Mark Thomas wrote: > All, > > I was thinking about this on my way back from ApacheCon and we probably > need to get some advice out to users early next week. > > My current understanding is that the MITM attack is triggered by a > renegotiation. > > On this basis I

Re: SSL & Tomcat

2009-11-07 Thread Bill Barker
"Mark Thomas" wrote in message news:4af5a776.70...@apache.org... > All, > > I was thinking about this on my way back from ApacheCon and we probably > need to get some advice out to users early next week. > > My current understanding is that the MITM attack is triggered by a > renegotiation. > >

svn commit: r833800 - /tomcat/tc6.0.x/trunk/STATUS.txt

2009-11-07 Thread billbarker
Author: billbarker Date: Sun Nov 8 01:50:41 2009 New Revision: 833800 URL: http://svn.apache.org/viewvc?rev=833800&view=rev Log: vote Modified: tomcat/tc6.0.x/trunk/STATUS.txt Modified: tomcat/tc6.0.x/trunk/STATUS.txt URL: http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/STATUS.txt?rev=83

Re: SSL & Tomcat

2009-11-07 Thread Henri Yandell
On Sat, Nov 7, 2009 at 8:59 AM, Mark Thomas wrote: > All, > > I was thinking about this on my way back from ApacheCon and we probably > need to get some advice out to users early next week. > > My current understanding is that the MITM attack is triggered by a > renegotiation. > > On this basis I