Re: How to limit the number of sessions per IP address (DOS attacks)

2012-09-30 Thread Konstantin Kolinko
2012/9/30 Brian Braun brianbr...@gmail.com: Hi, I'm using Tomcat 7.0.22 (+Ubuntu Linux + MySQL). I'm providen a geolocation service. My users invoque a URL in my server (something like http://services.acme.com/locate?ip=..) providing the IP address, and it responds with the geolocation

Re: Security issue regarding JSESSIONID cookie

2012-09-30 Thread Konstantin Kolinko
2012/9/28 Christopher Schultz ch...@christopherschultz.net: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Konstantin, On 9/28/12 10:27 AM, Konstantin Kolinko wrote: 2012/9/28 Joan Morales joan@gmail.com: Hi, I have a security issue (hijack session) with JSESSIONID cookie, here is

Re: maxHTTPHeaderSize, and specific header lengths

2012-09-30 Thread Konstantin Kolinko
2012/9/28 Andrew Todd andrew.todd...@gmail.com: I have a question about maxHttpHeaderSize [0]. In Apache httpd, there are two different parameters that affect the maximum size of an HTTP header, limitRequestFieldSize and limitRequestLine. [1] These configuration values specify about 8

Re: high CPU usage on tomcat 7

2012-09-30 Thread Jeff MAURY
I don't think a cpu loop will make tomcat stopping responding to requests I will make it very slow to respond But a shortage on memory is hard to recover Jeff Le vendredi 28 septembre 2012, mailingl...@j-b-s.de a écrit : Maybe an infinite loop? We observed something similar due to a bug in the

Re: Security issue regarding JSESSIONID cookie

2012-09-30 Thread Konstantin Kolinko
2012/9/30 Konstantin Kolinko knst.koli...@gmail.com: 2012/9/28 Christopher Schultz ch...@christopherschultz.net: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Konstantin, On 9/28/12 10:27 AM, Konstantin Kolinko wrote: 2012/9/28 Joan Morales joan@gmail.com: Hi, I have a security

Re: high CPU usage on tomcat 7

2012-09-30 Thread mailingl...@j-b-s.de
Well, if you have 4 cores and all cores are looping tomcat definitely will not respond any more... Von meinem iPad gesendet Am 30.09.2012 um 12:42 schrieb Jeff MAURY jeffma...@jeffmaury.com: I don't think a cpu loop will make tomcat stopping responding to requests I will make it very slow to

Re: How to limit the number of sessions per IP address (DOS attacks)

2012-09-30 Thread Brian Braun
Hi Constantine, 1- I had almost decided to program a filter. However, I have found this solution: http://stackoverflow.com/questions/3679465/find-number-of-active-sessions-created-from-a-given-client-ip/3679783#3679783 What do you think about it? I havent tried it yet, but as far as I can tell it