web.xml mime-mappings

2018-10-31 Thread Baron Fujimoto
Apologies in advance if this is a dumb question. I usually base our config files off of the sample config files as a starting point. The sample web.xml contains many mime-mapping elements (1000+ I think). Is there any good reason to include these if your application isn't going to use the vast

Re: Debugging tomcat native connector

2018-10-31 Thread Roger Brechbühl
with which connector do you have problems? nio, nio2 or apr? I ask because we have problems with nio2-openssl when ssl session is reused e.g. when a request is proxied with nginx. kind regards, Roger Mark A. Claassen schrieb am Mi. 31. Okt. 2018 um 15:32: > Is there a way to debug the native c

RE: Number of Web Applications in one Tomcat: THANKS!

2018-10-31 Thread George Stanchev
This is an interesting discussion. Are there any guides to alleviating management work of such deployments? For example, how do you deal with the port mapping? Or logs - do you collect at a common location or let each app log in its corner ? Can you share configuration across instances such as

[SECURITY] CVE-2018-11759 Apache Tomcat JK (mod_jk) Connector path traversal

2018-10-31 Thread Mark Thomas
CVE-2018-11759 Apache Tomcat JK (mod_jk) Connector path traversal Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Apache Tomcat JK mod_jk Connector 1.2.0 to 1.2.44 Description: The Apache Web Server (httpd) specific code that normalised the requested path befor

Re: Number of Web Applications in one Tomcat: THANKS!

2018-10-31 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Guido, On 10/31/18 05:14, Jäkel, Guido wrote: >> Has anyone ever attacked one of your web applications? There are >> some fun ways to make an application use a huge amount of memory. >> Just because the applications themselves are behaving doesn't >

Re: Number of Web Applications in one Tomcat: THANKS!

2018-10-31 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Tarek, On 10/31/18 03:19, Ahmed, Tarek wrote: > Christopher, > > Am 30.10.18 um 18:30 schrieb Christopher Schultz: > >> Has anyone ever attacked one of your web applications? There are >> some fun ways to make an application use a huge amount of m

Debugging tomcat native connector

2018-10-31 Thread Mark A. Claassen
Is there a way to debug the native connectors? Specifically, we are having some problems getting the native openssl connector working on Ubuntu. Doing an strace on the process shows a lot of FUTEX_WAIT_PRIVATE, but we don't know why. We were hoping that there was some way to get more informatio

Re: Number of Web Applications in one Tomcat

2018-10-31 Thread logo
Tarek, Am 30.10.2018 14:39, schrieb Ahmed, Tarek: Am 30.10.18 um 13:13 schrieb logo: Mark, DEV (one webapp per tomcat) - Start-up time of "fat tomcats" multiplies, which leads to worsened availablity (e.g., our fattest tomcat contains 32 web services. It takes 4 minutes to start) You can

RE: Number of Web Applications in one Tomcat: THANKS!

2018-10-31 Thread Jäkel , Guido
>Has anyone ever attacked one of your web applications? There are some >fun ways to make an application use a huge amount of memory. Just >because the applications themselves are behaving doesn't mean that all >the users are behaving. > >For example, do you have a max POST size set for your applica

Re: Number of Web Applications in one Tomcat: THANKS!

2018-10-31 Thread Ahmed, Tarek
Christopher, Am 30.10.18 um 18:30 schrieb Christopher Schultz: > Has anyone ever attacked one of your web applications? There are some > fun ways to make an application use a huge amount of memory. Just > because the applications themselves are behaving doesn't mean that all > the users are behav