Bypassing Ldap in tomcat .

2024-08-15 Thread Shekhar Dhotre
Hello Expert , Which is the configuration file wheee we can tell tomcat to bypass Ldap authentication and log in directly to oracle ? We have IBM ldap whose password is not known so failing on authentication . Thanks Shekhar

Re: How to Prevent Dynamic Code manipulation via Java Attach API for Tomcat

2024-08-15 Thread George Sexton
There's just so many bad practices here... First, a production machine should not have debugging enabled. Problem solved. Second, a development machine with debugging enabled should not be exposed to the internet. Problem solved. Next, someone would have to gain access to the machine to do

How to Prevent Dynamic Code manipulation via Java Attach API for Tomcat

2024-08-15 Thread Bhavesh Mistry
Hello Tomcat Users and Development Team, I recently came to know that with Java Attach API, anyone with access can attach to a local process and manipulate Java Byte code. For example, password harvesting is attached to the Filter Chain. https://github.com/rebeyond/memShell What I found is to ru

Re: Might switching to Tomcat 9 solve this?

2024-08-15 Thread Chuck Caldarale
> On Aug 15, 2024, at 11:20, James H. H. Lampert > wrote: > > In the wake of my recently switching a customer over from 8.5 to 9.0, a > question came up about another customer installation. > > They are quite possibly the most heavily loaded customer installation we have > (and they also ha

Might switching to Tomcat 9 solve this?

2024-08-15 Thread James H. H. Lampert
In the wake of my recently switching a customer over from 8.5 to 9.0, a question came up about another customer installation. They are quite possibly the most heavily loaded customer installation we have (and they also have a chronic problem with disk space). They have a chronic problem with

Re: Refresh my memory: Any "gotchas" in going from Tomcat 8.5 to Tomcat 9?

2024-08-15 Thread James H. H. Lampert
On 8/14/24 6:12 PM, Chuck Caldarale wrote: The blocking IO implementation (http11.Http11Protocol) was actually removed in 8.5, but if specified in the config, 8.5 would substitute the default non-blocking one (http11.Http11NioProtocol). In 9.0, this auto-substitution was removed, requiring a val

RE: Web browser clocking issue at Apache Tomcat 10.1.20 on Linux

2024-08-15 Thread Tim Zielke
When the web browser clocking issue happens, the web browser will just clock when I click on a link in this application and then eventually time out on the browser side. The TCP connections mentioned in original posting represent this web browser click that clocked and eventually timed out at th

Re: Web browser clocking issue at Apache Tomcat 10.1.20 on Linux

2024-08-15 Thread Mark Thomas
On 15/08/2024 14:36, Tim Zielke wrote: web browser clocking issues Can you clarify what you mean by this please. Mark - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h

Web browser clocking issue at Apache Tomcat 10.1.20 on Linux

2024-08-15 Thread Tim Zielke
Hello, Even though the application mentioned below is a Spring Boot 3 application, I am looking for Apache Tomcat help here as my question involves understanding trace records from the org.apache.tomcat.util.net.NioEndpoint class. I have a Spring Boot 3 application using Apache Tomcat 10.1.20 t