Talk:Securing tomcat - Revision history

Kenneth Kron at 00:38, 23 August 2014

2014-08-23T00:38:03Z

2014-08-22T21:56:48Z

2014-03-27T11:19:06Z

2011-10-06T13:49:25Z

2011-08-12T17:07:06Z

2011-08-12T17:06:19Z

2011-06-08T23:16:10Z

2011-06-08T23:15:55Z

2011-06-08T23:15:28Z

2010-06-18T13:40:58Z

@@ Line 79: / Line 79: @@
 http://tomcat.apache.org/tomcat-7.0-doc/security-howto.html#Securing_Management_Applications
 http://chandank.com/application-server/tomcat/apache-tomcat-hardening-and-security-guide
 [[User:Kenneth Kron|Kenneth Kron]] ([[User talk:Kenneth Kron|talk]]) 16:56, 22 August 2014 (CDT)

← Older revision		Revision as of 21:56, 22 August 2014
Line 73:		Line 73:

	[[User:Dirk Wetter]] 2014-03-27 : Those ciphers were maybe ok in 2011, in 2014 I would not recommend using RC4 and CBC ciphers!		[[User:Dirk Wetter]] 2014-03-27 : Those ciphers were maybe ok in 2011, in 2014 I would not recommend using RC4 and CBC ciphers!
		+
		+	== No missing steps required in Tomcat 7 or 8 ==
		+	I've done some research and as far as I can tell there are no recommended hardening steps for Tomcat 7 or 8 missing from this guide.
		+
		+	http://tomcat.apache.org/tomcat-7.0-doc/security-howto.html#Securing_Management_Applications
		+	http://chandank.com/application-server/tomcat/apache-tomcat-hardening-and-security-guide
		+
		+	[[User:Kenneth Kron\|Kenneth Kron]] ([[User talk:Kenneth Kron\|talk]]) 16:56, 22 August 2014 (CDT)

← Older revision		Revision as of 11:19, 27 March 2014
Line 71:		Line 71:

	[[User:Psiinon]] 2011-10-06		[[User:Psiinon]] 2011-10-06
		+
		+	[[User:Dirk Wetter]] 2014-03-27 : Those ciphers were maybe ok in 2011, in 2014 I would not recommend using RC4 and CBC ciphers!

@@ Line 39: / Line 39: @@
 In both cases, ${catalina.home} is typically either the root of your local installation, or your global installation if you are making use of disjoint installs using ${catalina.base} to provide instance-specific information.
 == autoDeploy feature ==
@@ Line 47: / Line 45: @@
 [[User:Pierre Ernst|Pierre Ernst]] 2011-08-12

@@ Line 40: / Line 40: @@
 In both cases, ${catalina.home} is typically either the root of your local installation, or your global installation if you are making use of disjoint installs using ${catalina.base} to provide instance-specific information.
-[[User:Pierre Ernst|Pierre Ernst]] 2011-08-12
 == autoDeploy feature ==
 Wouldn't it make sense to disable the autoDeploy feature in production environments for added security?

← Older revision		Revision as of 17:06, 12 August 2011
Line 39:		Line 39:

	In both cases, ${catalina.home} is typically either the root of your local installation, or your global installation if you are making use of disjoint installs using ${catalina.base} to provide instance-specific information.		In both cases, ${catalina.home} is typically either the root of your local installation, or your global installation if you are making use of disjoint installs using ${catalina.base} to provide instance-specific information.
		+
		+	[[User:Pierre Ernst\|Pierre Ernst]] 2011-08-12
		+
		+	== autoDeploy feature ==
		+
		+	Wouldn't it make sense to disable the autoDeploy feature in production environments for added security?

@@ Line 33: / Line 33: @@
   # For Tomcat 5.5 (inject your new file onto the path of the server classloader):
   ${catalina.home}/server/classes/org/apache/catalina/util/ServerInfo.properties
   # For Tomcat 6 (inject it onto the path of the common classloader, or whichever classloader is loading catalina.jar):
   ${catalina.home}/lib/org/apache/catalina/util/ServerInfo.properties
 In both cases, ${catalina.home} is typically either the root of your local installation, or your global installation if you are making use of disjoint installs using ${catalina.base} to provide instance-specific information.

← Older revision		Revision as of 23:15, 8 June 2011
Line 27:		Line 27:

	[[User:Simon Bennetts\|Simon Bennetts]] 14:40, 18 June 2010 (UTC)		[[User:Simon Bennetts\|Simon Bennetts]] 14:40, 18 June 2010 (UTC)
		+
		+	== Overriding Tomcat Version Number ==
		+
		+	Rebuilding the catalina.jar to alter ServerInfo.properties may not be an ideal way to override the version number, the same effect can be achieved without repackaging JARs in the default distribution (repackaging can be somewhat intrusive and/or impractical). Classloader classpaths can be patched using strategically placed files on the classpath. Classes that are loaded first always take precedence, the same goes for properties files, hence you can override by creating files in the following places:
		+
		+	For Tomcat 5.5 (inject your new file onto the path of the server classloader):
		+
		+	${catalina.home}/server/classes/org/apache/catalina/util/ServerInfo.properties
		+
		+	For Tomcat 6 (inject it onto the path of the common classloader, or whichever classloader is loading catalina.jar):
		+
		+	${catalina.home}/lib/org/apache/catalina/util/ServerInfo.properties
		+
		+	In both cases, ${catalina.home} is typically either the root of your local installation, or your global installation if you are making use of disjoint installs using ${catalina.base} to provide instance-specific information.

← Older revision		Revision as of 13:40, 18 June 2010
Line 25:		Line 25:
	...		...
	</Context>		</Context>
		+
		+	[[User:Simon Bennetts\|Simon Bennetts]] 14:40, 18 June 2010 (UTC)