security issue: tomcat on port 80

How safe is it to have tomcat listening on port 80 running on a RH6.2, which is on the internet ? Did anybody face any security problems ever ? Nokia 5510 looks weird sounds great. Go to http://uk.promotions.yahoo.com/nokia/ dis

RE: security issue: tomcat on port 80

system administration and do some web searches, there's plenty of information out there. Hope this helps, Chris -Original Message- From: E B [mailto:[EMAIL PROTECTED]] Sent: 06 December 2001 09:55 To: Tomcat Users List Subject: security issue: tomcat on port 80 How safe is it to

Re: security issue: tomcat on port 80

. - Original Message - From: "Chris Newland" <[EMAIL PROTECTED]> To: "Tomcat Users List" <[EMAIL PROTECTED]> Sent: 2001. december 6. 12:18 Subject: RE: security issue: tomcat on port 80 > Hi, > > There are security implications for running *an

Re: security issue: tomcat on port 80

--- Attila Szegedi <[EMAIL PROTECTED]> wrote: > Java VM actually shields you from buffer overflow > attacks, since you cannot > overflow an array, let alone do it so that it > overwrites code segments. So > in case of Tomcat (or any Java-written server), > buffer overflow attacks are > out of que

AW: security issue: tomcat on port 80

Ursprüngliche Nachricht- > Von: Attila Szegedi [mailto:[EMAIL PROTECTED]] > Gesendet: Donnerstag, 6. Dezember 2001 12:57 > An: Tomcat Users List > Betreff: Re: security issue: tomcat on port 80 > Java VM actually shields you from buffer overflow attacks, > since you cannot o

Re: security issue: tomcat on port 80

> How safe is it to have tomcat listening on port 80 > running on a RH6.2, which is on the internet ? > Did anybody face any security problems ever ? >From the conventional point of view, having things run on port 80 has been dangerous because a proc has to have uid 0 to bind to the port. Apache

RE: security issue: tomcat on port 80

port and placed behind the firewall. I feel much more secure running Tomcat then IIS on Win32. Jim -Original Message- From: Dr. Evil [mailto:[EMAIL PROTECTED]] Sent: Thursday, December 06, 2001 1:48 PM To: [EMAIL PROTECTED] Subject: Re: security issue: tomcat on port 80 > How safe

AW: security issue: tomcat on port 80

See below: > -Ursprüngliche Nachricht- > Von: Dr. Evil [mailto:[EMAIL PROTECTED]] > Gesendet: Donnerstag, 6. Dezember 2001 20:48 > An: [EMAIL PROTECTED] > Betreff: Re: security issue: tomcat on port 80 > However, the reason why uid 0 is so dangerous for Apache is beca

Re: AW: security issue: tomcat on port 80

> The VM itself is typically writen in C/C++, so I wouldn't beg on more=20 > safety for a VM than Apache. That's probably true. However, the likelihood of someone being able to send a web request to Tomcat that will result in Tomcat triggering a buffer overflow in the VM seems ridiculously small

AW: AW: security issue: tomcat on port 80

ult to configure and maintain, that it was hard to get more security whithout affecting the ease of use for the daily work. > -Ursprüngliche Nachricht- > Von: Dr. Evil [mailto:[EMAIL PROTECTED]] > Gesendet: Freitag, 7. Dezember 2001 09:20 > An: [EMAIL PROTECTED] > Betreff: R

Re: AW: security issue: tomcat on port 80

Dr. Evil: Have you tried asking your question in the linux mailing lists ? What do those guys got to say about this restriction to bind to ports < 1024 in the present day server systems? --- "Dr. Evil" <[EMAIL PROTECTED]> wrote: > > The VM itself is typically writen in C/C++, so I > wouldn't b

Re: AW: security issue: tomcat on port 80

> Have you tried asking your question in the linux mailing lists ? > What do those guys got to say about this restriction to bind to > ports < 1024 in the present day server systems? I asked once on the OpenBSD list. Those guys are very much traditionalists so they did not like the idea. Still,

Re: AW: security issue: tomcat on port 80

> I asked once on the OpenBSD list. Those guys are > very much > traditionalists so they did not like the idea. > Still, there is no > longer any rational reason for this restriction. I > challenge anyone > to point out a good reason for it. Basically, it I discussed this on a local LUG. It s

Re: AW: security issue: tomcat on port 80

Ok, this subject is getting pretty far from Tomcat, but I'll address this. > > I asked once on the OpenBSD list. Those guys are very much > > traditionalists so they did not like the idea. Still, there is no > > longer any rational reason for this restriction. I challenge > > anyone to point o

Re: AW: AW: security issue: tomcat on port 80

> The past 12 years I worked constantly for companies that had one or > more unix servers and always only a small number of users had an > admin=20 account, all other had 'normal' user accounts. Anyway, can someone explain to me the security benefit of restricting bind < 1024 to uid 0? At this p