Re: [ANN] Apache Tomcat 9.0.31 available

2020-02-12 Thread Stefan Mayr
Hi, > - AJP defaults changed to listen the loopback address, require a secret > and to be disabled in the sample server.xml What was the motivation behind this breaking change to require a secret or to explitly disable it? What makes an open AJP connector more unsafe than an open HTTP connector

Re: JVM job for Tomcat taking lots and lots of CPU

2020-02-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 James, On 2/12/20 4:53 PM, James H. H. Lampert wrote: > Here is a "Display Java Threads" from the Tomcat server's JVM job: > >> Total Aux ThreadName Status CPU >> I/O 0011 main SELW 1.100 13

Re: JVM job for Tomcat taking lots and lots of CPU

2020-02-12 Thread James H. H. Lampert
From the : How many VPs does your partition have? Hardware: Power7 vs Power8/Power9? How many GC threads? I wish I knew how to determine the answers to these. What I *do* know is that the box in question self-IDs as model "22A" (which I've never heard of, which in itself suggests Power9), wi

RE: JVM job for Tomcat taking lots and lots of CPU

2020-02-12 Thread John.E.Gregg
James, > -Original Message- > From: James H. H. Lampert > Sent: Wednesday, February 12, 2020 12:47 PM > To: Tomcat Users List ; Java 400 List l...@lists.midrange.com> > Subject: Re: JVM job for Tomcat taking lots and lots of CPU > > I've got some more detailed GC stats. The full repor

Re: JVM job for Tomcat taking lots and lots of CPU

2020-02-12 Thread James H. H. Lampert
I've got some more detailed GC stats. The full report runs 600 pages for just the last 300 GC cycles, so I've just included three cycles worth of data: GC Cycle Number : 1801 Basic GC Cycle Information: Current

RE: [OT] Has anyone ever implemented an FTP server using the Servlet API?

2020-02-12 Thread Rouse, Ed
I did one about 20 years ago. Created a jar file that could be run from whichever dir was set up to allow jar files and give me a file explorer Like view in the browser that allowed directory traversal as well as file up and download. I used it in security testing to check whether a web Site was

Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Jon, On 2/12/20 12:34 PM, Jonathan S. Fisher wrote: > So the manager would be this, I've noticed it uses the > StandardSession, which explicitly prevents serialization of the > user principal and auth type: > org.redisson.tomcat.RedissonSessionManag

[OT] Has anyone ever implemented an FTP server using the Servlet API?

2020-02-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 All, This is a weird question, I know. FTP, really? Well, I have a product[1] that can deliver files via SFTP and FTPS but not via a web service (e.g. HTTP PUT). I was wondering how feasible it would be to build an FTP endpoint which could accept a

Re: JVM job for Tomcat taking lots and lots of CPU

2020-02-12 Thread James H. H. Lampert
On 2/12/20 5:37 AM, Niranjan Babu Bommu wrote: have you turned on codecahe , if that is true can you monitor codecahe? known issue with codecache in java 7, when codecache fills up the compiler may not get get restarted even after the codecache occupancy drops down to half after the emergency flu

Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-12 Thread Klein, Carsten
Jonathan, So the manager would be this, I've noticed it uses the StandardSession, which explicitly prevents serialization of the user principal and auth type: org.redisson.tomcat.RedissonSessionManager Two questions, on org.apache.catalina.Session, do the values getNote and setNote replicate ac

Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-12 Thread Jonathan S. Fisher
So the manager would be this, I've noticed it uses the StandardSession, which explicitly prevents serialization of the user principal and auth type: org.redisson.tomcat.RedissonSessionManager Two questions, on org.apache.catalina.Session, do the values getNote and setNote replicate across the clus

Re: Some attribute lost after calling storeConfig

2020-02-12 Thread Rémy Maucherat
On Wed, Feb 12, 2020 at 5:17 PM Arnaud Yahoo wrote: > Thanks for you reply, shall I fill a bug for this ? > No need. The fix will be in 9.0.32 and 8.5.52. Rémy > > On 12/02/2020 16:43, Rémy Maucherat wrote: > > On Wed, Feb 12, 2020 at 3:05 PM Arnaud Yahoo > > wrote: > > > >> Hello, > >> > >>

Re: Question on HttpSession investigation

2020-02-12 Thread Konstantin Kolinko
пн, 10 февр. 2020 г. в 02:32, M. Manna : > > [...], we would like > to check using JMX whether this is present somewhere in session. Debugging > has not resulted into a successful outcome. > > We appreciate if this is not possible, but just wanted to check if tomcat > currently emits anything relat

Re: Some attribute lost after calling storeConfig

2020-02-12 Thread Arnaud Yahoo
Thanks for you reply, shall I fill a bug for this ? On 12/02/2020 16:43, Rémy Maucherat wrote: On Wed, Feb 12, 2020 at 3:05 PM Arnaud Yahoo wrote: Hello, Recently storeConfig has been fixed thanks to https://github.com/apache/tomcat/commit/010fdb7e458d9d8755e2b67203ac4757d78c2f64 It is ver

Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Carsten, On 2/12/20 10:54 AM, Klein, Carsten wrote: > actually, Tomcat just does not serialize authentication > information, that is AuthType (BASIC, DIGEST etc.) and the > Principal, during session serialization. That affects session > persistence

Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-12 Thread Rémy Maucherat
On Wed, Feb 12, 2020 at 4:55 PM Klein, Carsten wrote: > Hi there, > > actually, Tomcat just does not serialize authentication information, > that is AuthType (BASIC, DIGEST etc.) and the Principal, during session > serialization. That affects session persistence across restarts (no > matter what

Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-12 Thread Klein, Carsten
Hi there, actually, Tomcat just does not serialize authentication information, that is AuthType (BASIC, DIGEST etc.) and the Principal, during session serialization. That affects session persistence across restarts (no matter what manager is used) as well as session transfer between cluster n

Re: Cross-session Persistent Object?

2020-02-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Jerry, On 2/11/20 6:55 PM, Jerry Malcolm wrote: > > On 2/11/2020 4:32 PM, Christopher Schultz wrote: > > Jerry, > > On 2/11/20 3:11 PM, Jerry Malcolm wrote: I need some advice. I need to maintain a set of long-running threads. When a r

Re: Some attribute lost after calling storeConfig

2020-02-12 Thread Rémy Maucherat
On Wed, Feb 12, 2020 at 3:05 PM Arnaud Yahoo wrote: > Hello, > > Recently storeConfig has been fixed thanks to > > https://github.com/apache/tomcat/commit/010fdb7e458d9d8755e2b67203ac4757d78c2f64 > > It is very interesting, because it allows to persist across restart > configurations made to tomc

RE: JVM job for Tomcat taking lots and lots of CPU

2020-02-12 Thread John.E.Gregg
James, > -Original Message- > From: James H. H. Lampert > Sent: Tuesday, February 11, 2020 6:41 PM > To: Tomcat Users List > Subject: JVM job for Tomcat taking lots and lots of CPU > > Ladies and Gentlemen: > > We have a customer installation in which the JVM job for our Tomcat server

Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Jon, On 2/11/20 9:33 PM, Jonathan S. Fisher wrote: > Apologies, I'm not seeing how this helps, I don't see where > authentication information is transmitted No, seriously, what session manager are you using? - -chris > On Tue, Feb 11, 2020 at 5:3

Some attribute lost after calling storeConfig

2020-02-12 Thread Arnaud Yahoo
Hello, Recently storeConfig has been fixed thanks to https://github.com/apache/tomcat/commit/010fdb7e458d9d8755e2b67203ac4757d78c2f64 It is very interesting, because it allows to persist across restart configurations made to tomcat itself and deployed webapp through JMX. In my case after sa

Re: JVM job for Tomcat taking lots and lots of CPU

2020-02-12 Thread Suvendu Sekhar Mondal
Hello James, On Wed, Feb 12, 2020, 6:10 AM James H. H. Lampert wrote: > Ladies and Gentlemen: > > We have a customer installation in which the JVM job for our Tomcat > server is frequently using massive amounts of CPU. > > It's Tomcat 7.0.67, running on an AS/400, in a 64-bit Java 7 JVM, with >

Re: JVM job for Tomcat taking lots and lots of CPU

2020-02-12 Thread Niranjan Babu Bommu
have you turned on codecahe , if that is true can you monitor codecahe? known issue with codecache in java 7, when codecache fills up the compiler may not get get restarted even after the codecache occupancy drops down to half after the emergency flushing, this may cause high cpu usage by the compi

[ANN] Apache Tomcat 8.5.51 available

2020-02-12 Thread Mark Thomas
The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.51. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and Java Authentication Service Provider Interface for Containers t

[ANN] Apache Tomcat 9.0.31 available

2020-02-12 Thread Mark Thomas
The Apache Tomcat team announces the immediate availability of Apache Tomcat 9.0.30. Apache Tomcat 9 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC technologies. Apache Tomcat 9.0.31 is a bugfix and feat