Re: [OT] UserDatabase & security

2007-05-19 Thread Pid
Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Pid, Pid wrote: I'm trying to write a regex that will turn Mr Kewl's posts into something readable, if anyone would care to help. How about: s/wot/what/g s/\.\.\./.\n/g Many thanks. I will add your first rule, and:

Re: [OT] UserDatabase & security

2007-05-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Pid, Pid wrote: > I'm trying to write a regex that will turn Mr Kewl's posts into > something readable, if anyone would care to help. How about: s/wot/what/g s/\.\.\./.\n/g That ought to help quite a bit ;) - -chris -BEGIN PGP SIGNATURE-

Re: UserDatabase & security

2007-05-19 Thread Johnny Kewl
Ha ha... if you get it working, I'll buy it from you ;) - Original Message - From: "Pid" <[EMAIL PROTECTED]> To: "Tomcat Users List" Sent: Saturday, May 19, 2007 11:00 AM Subject: Re: UserDatabase & security I'm trying to write a regex that w

Re: UserDatabase & security

2007-05-19 Thread Pid
mn difficult to get at sensitive passwords yes. ... have fun - Original Message - From: "Jerome Benezech" <[EMAIL PROTECTED]> To: Sent: Friday, May 18, 2007 6:29 AM Subject: UserDatabase & security Hi, I have a question regarding Tomcat server UserDatabase on Lin

Re: UserDatabase & security

2007-05-18 Thread Mark Thomas
Jerome Benezech wrote: > Thanks for the info, that would do great. > Any link on documentation to configure tomcat that way > ? Would it have killed you to spend 30 seconds looking for this yourself? http://tomcat.apache.org/tomcat-6.0-doc/security-manager-howto.html Mark --

Re: UserDatabase & security

2007-05-18 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jacob, Jacob Rhoden wrote: > Jerome Benezech wrote: >> In this case, which user would be authenticated in >> LDAP ? If th user connecting to LDAP is 'tomcat', the >> issue remains no ? >> > Not quite. You reconfigure tomcat to use LDAP to lookup pa

Re: UserDatabase & security

2007-05-18 Thread Jerome Benezech
Thanks for the info, that would do great. Any link on documentation to configure tomcat that way ? --- Mark Thomas <[EMAIL PROTECTED]> wrote: > Jerome Benezech wrote: > > Is there a way to ensure that only the root user > can > > read this file ? > > Not quite root only but it will meet your > r

Re: UserDatabase & security

2007-05-18 Thread Mark Thomas
Jerome Benezech wrote: > Is there a way to ensure that only the root user can > read this file ? Not quite root only but it will meet your requirement... Run Tomcat under a security manager. That way, webapps don't have access to files outside the docBase without explicit permissions being define

Re: UserDatabase & security

2007-05-18 Thread Johnny Kewl
you make it damn difficult to get at sensitive passwords yes. ... have fun - Original Message - From: "Jerome Benezech" <[EMAIL PROTECTED]> To: Sent: Friday, May 18, 2007 6:29 AM Subject: UserDatabase & security Hi, I have a question regarding To

Re: UserDatabase & security

2007-05-18 Thread Jerome Benezech
Right, stupid comment Will see if we can do with LDAP or maybe just putting digested passwords would be ok. Thanks for your help Jerome --- Jacob Rhoden <[EMAIL PROTECTED]> wrote: > Jerome Benezech wrote: > >> As far as I am aware you cannot resolve this > problem > >> except by switching >

Re: UserDatabase & security

2007-05-18 Thread Jacob Rhoden
Jerome Benezech wrote: As far as I am aware you cannot resolve this problem except by switching to LDAP for your authentication. (Although I would be happy to be corrected!) In this case, which user would be authenticated in LDAP ? If th user connecting to LDAP is 'tomcat', the issue rem

Re: UserDatabase & security

2007-05-17 Thread Markus Schönhaber
Jerome Benezech wrote: > I have a question regarding Tomcat server UserDatabase > on Linux. > When choosing a MemoryUserDatabase, tomcat users and > passwords are declared in a tomcat-users.xml file. The > tomcat user running the server must have read > permission on this file. > At the same time

Re: UserDatabase & security

2007-05-17 Thread Jerome Benezech
> As far as I am aware you cannot resolve this problem > except by switching > to LDAP for your authentication. (Although I would > be happy to be > corrected!) In this case, which user would be authenticated in LDAP ? If th user connecting to LDAP is 'tomcat', the issue remains no ? > > Which

Re: UserDatabase & security

2007-05-17 Thread Jacob Rhoden
As far as I am aware you cannot resolve this problem except by switching to LDAP for your authentication. (Although I would be happy to be corrected!) For any larger scale hosting, LDAP provides a more secure solution. (However it does add an extra point of failure). Any hosting solution wher

UserDatabase & security

2007-05-17 Thread Jerome Benezech
Hi, I have a question regarding Tomcat server UserDatabase on Linux. When choosing a MemoryUserDatabase, tomcat users and passwords are declared in a tomcat-users.xml file. The tomcat user running the server must have read permission on this file. At the same time, all webapps running in tomcat ar