3

This question is not about performance, nor about load-balancing, etc.

Which would be more secure: running Tomcat in standalone mode or running Tomcat behind apache?

The thing is, Tomcat is written in Java and hence it is pretty much immune to buffer overrun/overflow (unless a buffer overrun in a C-written lib used by Tomcat can be triggered, but they're rare [the last I remember was in zlib, many many moons ago] and one heck of a hack to actually exploit), which gets rid of a lot of potential exploits.

This page:

http://wiki.apache.org/tomcat/FAQ/Security

has this to say:

There have been no public cases of damage done to a company, organization, or individual due to a Tomcat security issue... there have been only theoretical vulnerabilities found. All of those were addressed even though there were no documented cases of actual exploitation of these vulnerabilities.

This, combined with the fact that buffer overrun/overflow are pretty much non-existent in Java, makes me believe that Tomcat in standalone mode is pretty secure.

In addition to that, I can install both Java and Tomcat on Linux without needing to be root. The only moment I need to be root is to set up a transparent port 8080 to port 80 forwarding (and 8443 to 443). Two iptables line as root, that's all root is needed for. (I don't know for Apache).

Apache is much more used than Tomcat and definitely does not have a security track record as good as Tomcat.

What would make Tomcat + Apache more secure?

What would make Tomcat + Apache less secure?

In short: which is more secure, Tomcat standalone or Tomcat with Apache? (remembering that performance aren't an issue here)

Some background on the subject, here on the Tomcat mailing list in 2007:

http://mail-archives.apache.org/mod_mbox/tomcat-users/200710.mbox/%[email protected]%3E

Short answer: if you don't see a compelling reason to actively put an httpd in front of Tomcat, there most probably is none.

the claim one can sometimes read that you should always put an httpd in front of Tomcat is complete nonsense IMO. The opposite is true.

3
  • 1
    Apache httpd and Apache Tomcat, you mean. Jun 10, 2010 at 20:03
  • 2
    @Ignacio Vazquez-Abrams: yup of course ;) "Apache Apache" and "Apache Tomcat" :))) But common usage of "Apache" pretty much means "Apache httpd".
    – NoozNooz42
    Jun 10, 2010 at 20:42
  • +1... This question is four years old but We just had a very "nice" proof that Tomcat in standalone was more secure "than Apache + Tomcat": the "bash bug" aka "shellshock bash bug" / CVE-2014-6271 / CVE-2014-7169. Tomcat in standalone mode seems immune while many Apache + Tomcat servers are going to be owned pretty badly in the coming days / weeks. Sep 25, 2014 at 13:58

1 Answer 1

7

Update 2021:
I dont like my old answer. I am not changing it. But I don't like it.

Before update 2010:

What would make Tomcat + Apache less secure?

  1. Larger surface of attack. More code is parsing the request. So there is larger chance that a security bug is encountered/exploited.
  2. More fixes to install, More configuration files to get correct and more security setting to get right. Greater chance to human error.

What would make Tomcat + Apache more secure?

Don't know.

2
  • +1... I'm thinking along the same lines. Yet I'm surprised because there are so many people (probably because they're used to Apache) that constantly ask: "Why do you use Tomcat standalone?", hence my question. It's kinda mindboggling :)
    – NoozNooz42
    Jun 10, 2010 at 20:41
  • +1 here too. The discussion regarding Apache is one of added functionality that a Tomcat container shouldn't do. However, one pro-apache consideration would be something like a mod_security enabled apache, which is very useful. But the points above still hold.
    – mcauth
    Dec 20, 2011 at 2:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .