0
votes
0answers
53 views

How do you stop tomcat after changing the shutdown word in server.xml?

Running tomcat-7.0.33 on CentOS. I have a security requirement to change the tomcat shutdown word in server.xml to a random string of characters, so I need to go from this: <Server port="8005" ...
0
votes
0answers
20 views

Tomcat/TomEE default security policy

By running a default installation of Tomcat (took from Tomcat website), what is the reliability of its default security policy? I have to run it on a computer with Tomcat's port exposed to the ...
0
votes
1answer
53 views

A botnet may be attacking our site right now, how should we respond? [duplicate]

Not sure if SO is the right forum, but we're in need of help and perhaps programmatic elements may comprise the final solution. Instead of downvoting, please recommend where to post this question, and ...
0
votes
0answers
126 views

How vulnerabilities in the Java affects application running in Tomcat/JBoss

I wonder what impact has Java vulnerabilities on application in Tomcat. For example Java 1.6u45 has many reported security bugs (Remote Security Vulnerability). You can easily exploit it on client ...
1
vote
1answer
546 views

AWS: network ACL blocks outbound traffic

I am implementing a REST service in Amazon AWS. The internal servlets listen on numerous ports like 8080 and 9000, and an Apache configured as a reverse proxy serves them with proper URL schema using ...
1
vote
2answers
109 views

how do I avoid spam domains to point to my site or IP hosting tomcat application

I can across a issue where I saw some xyz.com is pointing to mydomain.com. I am not using Apache, nor IIS but Tomcat 7 directly. How to I avoid such other spam domains pointing to mydomain.com? I ...
0
votes
1answer
92 views

Tomcat vulnerability patching

I had a tomcat vulnerability scan in my linux server and report came as Important: Authentication bypass and information disclosure (CVE-2011-3190) .My apache tomcat is of version 6.0.24. tomcat ...
1
vote
0answers
100 views

How to secure tomcat manager for multiple instances

I have multiple instances of Tomcat setup using the CATALINA_BASE method. I need to enable the tomcat manager application for each of them, and to secure them all separately based on groups of users. ...
2
votes
0answers
39 views

Tomcat security without a Web Server [closed]

Can anyone tell me, from his experience, if is a good approach leaving Tomcat alone (in PRD) and not "hidden" behind a real web server as Apache or IIS? The application I am deplying on Tomcat is an ...
5
votes
3answers
3k views

Is Tomcat vulnerable to the Apache DoS vulnerability in CVE-2011-3192?

Is Tomcat affected by this vulnerability? Here is the advisory announcement.
0
votes
1answer
1k views

different levels of security configuration for Apache SOLR

this is what we need for our SOLR instance 1) all urls except for select need ip as well as password restrictions 2) select url can be accessed from any ip but needs a password to be accessed. this ...
1
vote
2answers
548 views

Efficient way to secure tomcat database connections

Our customer has a problem with database information in plaintext within a server.xml or context.xml file on the Tomcat server. I've looked at several sites like OWASP and it seems like there's no ...
3
votes
3answers
257 views

How to secure a vps based website?

If I have a vps hosting with linux, what should I do to be sure it has platform security ? I install a server (let's say tomcat), a database server (mysql) and then I deploy my application. Should I ...
1
vote
2answers
662 views

Hide port in URL when 80/433 already in use

I need to add another secure instance of Tomcat in a server that already uses port 80 and port 433. Is there any way to hide the port number of the new instance, since I'll need to use one which is ...
6
votes
3answers
4k views

Apache + Tomcat VS Stand Alone Tomcat or GlassFish

I am setting up a Debian server to serve Java web applications. I have done quite a bit of research for several weeks now. Tomcat's web site says it is better to use stand alone Tomcat for speed if ...
1
vote
2answers
297 views

tomcat - filtering traffic

I have had my new web application online for just about a week and have seen a host of attacks run against it already. Of all the attacks that I have logged, 75% of them are using the IP address of ...
6
votes
8answers
864 views

How can I prevent that a server admin can see data?

I am running Apache Tomcat on a Windows 2003 Server and I have data stored in a mySQL database. How can I prevent that a server admin can see any data?
9
votes
5answers
9k views

What steps should I take to secure Tomcat 6.x?

I am in the process of setting up an new Tomcat deployment, and want it to be as secure as possible. I have created a 'jakarta' user and have jsvc running Tomcat as a daemon. Any tips on directory ...