Re: Updating Tomcat-Server from Version 6.0.16 to 7.0.30

2012-09-19 Thread Andreas Stadelmeier
Pid wrote: >Try the latest 6.0.x first, then if your app is fine, try 7.0.x. >Things changed in 6 that sometimes catch people out. Okay, thank you! My problem is: I don't know anything about the behave of applications/webservices which the tomcat 6.0.16 is running at the moment. So I am not able

Re: very basic question about apache and tomcat

2012-09-19 Thread Thomas Rohde
Am 19.09.2012 23:31, schrieb Mead, Jen L: Hi Everybody, Now I will show my real ignorance about what I know after NOT working with Apache or Tomcat for several years now. I have been working on a project that allows our CGI web pages to authenticate users from their windows desktop against

Proxy Support in tomcat 7

2012-09-19 Thread Vijay Kumar
Hi all, I have a scenario where i don't want to contact from my application to a web-service using https. I don't want to change firewall details and want to enable 443 port. Is there any way that can configure a proxy and can handle this scenario. My application is deployed at tomcat 7 Thanks,

Re: very basic question about apache and tomcat

2012-09-19 Thread Jeff
I have a related question since we recently implemented authentication to AD via LDAP in our Tomcat WebApp but it currently prompts the user for every new session, even if they are hitting the site from their windows workstation that is already authenticated to the domain. Is there a way to do it

Re: very basic question about apache and tomcat

2012-09-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jen, On 9/19/12 5:52 PM, Mead, Jen L wrote: > That was very insightful. All the documentation that I am looking > into specifies apache as the application. Maybe, just maybe the > server.xml file will contain what I need to move forward. The lack >

Re: very basic question about apache and tomcat

2012-09-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 David, On 9/19/12 5:45 PM, David A. Rush wrote: > > On 2012-09-19 17:31, Mead, Jen L wrote: >> My basic question is: do I need to install apache as well as >> tomcat to have an httpd.conf file? I have tomcat running on >> several AIX servers, 6.1 an

Re: ajp_ilink_receive error - please advise

2012-09-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Django, On 9/19/12 5:38 PM, Django Radonich-Camp wrote: > apache: Apache/2.2.14 That's 9 revisions out of date. Any chance you can upgrade to 2.2.23 and re-test? Is it reliably reproducible? - -chris -BEGIN PGP SIGNATURE- Version: GnuPG/MacG

Re: Best practices for upgrading Tomcat on Windows?

2012-09-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 David, On 9/19/12 4:32 PM, David A. Rush wrote: > Is there a set of best practices documented anywhere for upgrading > Tomcat on Windows? I run Tomcat as a Windows service on several > machines. I can, and have many times, completely removed Tomcat

RE: very basic question about apache and tomcat

2012-09-19 Thread Mead, Jen L
That was very insightful. All the documentation that I am looking into specifies apache as the application. Maybe, just maybe the server.xml file will contain what I need to move forward. The lack of documentation for what I am trying to do is frustrating. I am not even sure I can do it with

Re: very basic question about apache and tomcat

2012-09-19 Thread David A. Rush
On 2012-09-19 17:31, Mead, Jen L wrote: My basic question is: do I need to install apache as well as tomcat to have an httpd.conf file? I have tomcat running on several AIX servers, 6.1 and 5.3, with tomcat 7.0.27 installed. I was doing a simple search to find the httpd.conf file when I rea

ajp_ilink_receive error - please advise

2012-09-19 Thread Django Radonich-Camp
hello. we are running an application on tomcat and experiencing intermittent periods where the application is non-responsive and thus non-functional. the general set up is apache and tomcat, with mod_proxy_ajp as the connector (specific details and configs below). during these events, the primar

very basic question about apache and tomcat

2012-09-19 Thread Mead, Jen L
Hi Everybody, Now I will show my real ignorance about what I know after NOT working with Apache or Tomcat for several years now. I have been working on a project that allows our CGI web pages to authenticate users from their windows desktop against Windows AD and not requiring any kind of unix

Best practices for upgrading Tomcat on Windows?

2012-09-19 Thread David A. Rush
Is there a set of best practices documented anywhere for upgrading Tomcat on Windows? I run Tomcat as a Windows service on several machines. I can, and have many times, completely removed Tomcat and reinstalled a new version, but there's probably a better way, particular for minor version updat

Re: sessions replication

2012-09-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Pid, On 9/19/12 2:08 PM, Pid * wrote: > On 19 Sep 2012, at 16:59, "Carrillo, Dan" > wrote: > >> Hi folks, My sessions are replicating across the cluster as >> indicated by my session listener debug output. E.g I can see the >> session created/destr

Re: Latest Tomcat release question...

2012-09-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Tony, On 9/19/12 11:44 AM, Tony Anecito wrote: > Ok does scanning scan the classes inside the library jars the app > uses? What would be the point of that? As previously discussed, this is a (somewhat foolish) requirement of the servlet specificatio

Re: R: how to read files in file system

2012-09-19 Thread Pid *
On 18 Sep 2012, at 07:22, "Ge Gestione Elaboratori(IBM Business Partner)" wrote: > Excuse me Dan: > attached the screenshot. Zeesh. Stop attaching it, paste some info inline in the message and stop being lazy. p > paolo > > -Messaggio originale- > Da: Daniel Mikusa [mailto:dmik...@vmw

Re: Profiling tomcat 7 on ubuntu with java profiler

2012-09-19 Thread Pid *
On 17 Sep 2012, at 13:55, Ragini wrote: > Hi experts, > > I profile tomcat with a java profiler. I expect that a Java Profiler is the best way to do that. > The profiler runs java agent and > profiles the tomcat server. So you said. That's awesome dude. > So I have created setenv.sh and put j

Re: Is there a REAL solution to the "BEAST attack" (CVE-2011-3389) for Tomcat 7.x

2012-09-19 Thread Pid *
Martin, You know what a turtle is? p On 15 Sep 2012, at 13:30, Martin Gainty wrote: > > Good Morning Brian > > from what Im seeing this is a Redhat Enterprise 4,5,6 bug which effects any > of the secure protocols such as sftp, scp and ssl and you would need to > implement the RH patch > ds

Re: sessions replication

2012-09-19 Thread Pid *
On 19 Sep 2012, at 16:59, "Carrillo, Dan" wrote: > Hi folks, > My sessions are replicating across the cluster as indicated by my session > listener debug output. E.g I can see the session created/destroyed messages > in each respective log. > I have a Service object that is serializable, which

Re: Tomcat Connector for Sun ONE Web Server 7.0 and Tomcat 6.0.x

2012-09-19 Thread Pid *
On 19 Sep 2012, at 16:59, Hassan Schroeder wrote: > On Wed, Sep 19, 2012 at 8:02 AM, Jay Rao wrote: >> Is there a Tomcat Connector for Sun ONE Web Server 7.0 and Tomcat 6.0.x >> running on RedHat Linux 5.7 64-bit ? >> >> If not, any idea on when will it would be available please ? > > My guess:

Re: Latest Tomcat release question...

2012-09-19 Thread Pid *
On 19 Sep 2012, at 16:45, Tony Anecito wrote: > Ok does scanning scan the classes inside the library jars the app uses? What > would be the point of that? How does Tomcat know which is a special library jar and which is not? (Unless you provide it with a list of jars to ignore.) p > > Tha

Re: Updating Tomcat-Server from Version 6.0.16 to 7.0.30

2012-09-19 Thread Pid *
On 19 Sep 2012, at 14:45, Andreas Stadelmeier wrote: > Hello guys, > > i would like to install the newest stable version of the Apache Tomcat > Server. I already got some stuff running on the old Tomcat v.6.0.16 > Server. > I want to ask you, if it is safe to do this update and if afterwards > my

Re: exploting tomcat vulnerability with example

2012-09-19 Thread Pid *
On 19 Sep 2012, at 13:20, Daniel Mikusa wrote: > On Sep 19, 2012, at 5:02 AM, Ragini wrote: > >> Hi all, >> >> For my research work I want to have different attacking scenarios which >> exploits vulnerability of JAVA based applications. This java applications >> can be just any web-application,

Re: mod_jk vs. mod_proxy

2012-09-19 Thread Shanti Suresh
Hi Chris, Appreciate your feedback. That is helpful. Thanks you! -Shanti On Tue, Sep 18, 2012 at 3:33 PM, Christopher Schultz < ch...@christopherschultz.net> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Shanti, > > On 9/18/12 10:04 AM, Shanti Suresh wr

sessions replication

2012-09-19 Thread Carrillo, Dan
Hi folks, My sessions are replicating across the cluster as indicated by my session listener debug output. E.g I can see the session created/destroyed messages in each respective log. I have a Service object that is serializable, which contains a String member variable (x) which is not initiali

Re: Tomcat Connector for Sun ONE Web Server 7.0 and Tomcat 6.0.x

2012-09-19 Thread Hassan Schroeder
On Wed, Sep 19, 2012 at 8:02 AM, Jay Rao wrote: > Is there a Tomcat Connector for Sun ONE Web Server 7.0 and Tomcat 6.0.x > running on RedHat Linux 5.7 64-bit ? > > If not, any idea on when will it would be available please ? My guess: When dead, dreaming Cthulhu wakes in his house at R'lyeh and

Re: Latest Tomcat release question...

2012-09-19 Thread Tony Anecito
Ok does scanning scan the classes inside the library jars the app uses? What would be the point of that?   Thanks, -Tony --- On Wed, 9/19/12, Christopher Schultz wrote: From: Christopher Schultz Subject: Re: Latest Tomcat release question... To: "Tomcat Users List" Date: Wednesday, September

Tomcat Connector for Sun ONE Web Server 7.0 and Tomcat 6.0.x

2012-09-19 Thread Jay Rao
Is there a Tomcat Connector for Sun ONE Web Server 7.0 and Tomcat 6.0.x running on RedHat Linux 5.7 64-bit ? If not, any idea on when will it would be available please ?

Re: configured truststore ignored by tomcat

2012-09-19 Thread Daniel Mikusa
On Sep 19, 2012, at 2:40 AM, marco_strull...@swissre.com wrote: > Hi all, > I have a tomcat 6.0.35 that needs to connect to a remote server using > https, so it is acting as a https client: it means that tomcat must have > the remote server certificate installed. > > The ideal solution I found

Updating Tomcat-Server from Version 6.0.16 to 7.0.30

2012-09-19 Thread Andreas Stadelmeier
Hello guys, i would like to install the newest stable version of the Apache Tomcat Server. I already got some stuff running on the old Tomcat v.6.0.16 Server. I want to ask you, if it is safe to do this update and if afterwards my v 6 compatible JSP-Files wont cause any problems. Thank you in adv

Re: Latest Tomcat release question...

2012-09-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Tony, On 9/18/12 7:10 PM, Tony Anecito wrote: > Thanks for the heads up about the memory issue. I looked over the > release notes before I posted here and did not remember reading > that. http://tomcat.apache.org/tomcat-7.0-doc/changelog.html It's

Re: exploting tomcat vulnerability with example

2012-09-19 Thread Daniel Mikusa
On Sep 19, 2012, at 5:02 AM, Ragini wrote: > Hi all, > > For my research work I want to have different attacking scenarios which > exploits vulnerability of JAVA based applications. This java applications can > be just any web-application, desktopapplication or any other. > > For this, I was t

Re: Accessing CoyoteRequest attributes in a Servlet

2012-09-19 Thread André Warnier
Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 André, On 9/18/12 9:47 AM, André Warnier wrote: Still talking about mod_jk, basically anything you set in Apache httpd using "SetEnv" for example, gets passed to Tomcat as a request attribute, through the AJP protocol.

Re: exploting tomcat vulnerability with example

2012-09-19 Thread Ragini
On 09/19/2012 01:49 PM, chris derham wrote: On Wed, Sep 19, 2012 at 10:02 AM, Ragini wrote:For my research work I want to have different attacking scenarios which exploits vulnerability of JAVA based applications. This java applications can be just any web-application, desktopapplication or any

Re: exploting tomcat vulnerability with example

2012-09-19 Thread chris derham
On Wed, Sep 19, 2012 at 10:02 AM, Ragini wrote:For my research work I want to have different attacking scenarios which exploits vulnerability of JAVA based applications. This java applications can be just any web-application, desktopapplication or any other.For this, I was thinking to exploit vuln

exploting tomcat vulnerability with example

2012-09-19 Thread Ragini
Hi all, For my research work I want to have different attacking scenarios which exploits vulnerability of JAVA based applications. This java applications can be just any web-application, desktopapplication or any other. For this, I was thinking to exploit vulnerabilities of tomcat itself (b