Tag Info

Hot answers tagged

24

I can't think of any Ubuntu-specific tweaks, but here's a few that apply to all distributions: Uninstall all unnecessary packages Use public-key only authentication in SSH Disable root logins via SSH (doesn't apply to Ubuntu) Use the production settings for PHP (php.ini-recommended) Configure MySQL to use sockets only Of course this list isn't complete, ...


16

One quick thing that I do early on is install DenyHosts. It will regularly look through the /var/log/secure, looking for failed logins, and after a couple of failures, block the IP. I set it to block after the first no-such-user, on the second attempt at root, and after a couple of tries for real users (in case you mess up, but you should be using a SSH ...


10

Ubuntu is based off Debian and I've found the Securing Debian Manual to be very useful in Debian-based distributions in completely walking you through your system and checking every part. It's basically a really, really comprehensive answer to your question.


6

We have studied relative performance of JBoss vs. Glassfish, and found that Glassfish scales much better under high loads.


6

Don't forget to consider Jetty. I like very much: its ease of configuration and deployment (just unzip it and optionally edit one config file) the fact that it's easily embeddable in other applications (with a single jar) its support for continuations a lot before the Servlet 3 spec is ready Check this comparison out, it's done by a Jetty dev, but it's ...


6

Tomcat is definitely an application server, as it will happily process Java server-side code in order to generate dynamic contents, while instead a "pure" web server (like Apache) can only serve static web pages; so your teacher is totally wrong here. What is right is that Tomcat doesn't provide native JSF support; but the more than 4500000 results shown by ...


5

I've just been through this process (literally in the last week) with JIRA+Crowd+Confluence on a WinXP box. (not a 64-bit server OS but probably very similar) It's not hard to set up Apache + the appropriate proxy info so from the outside you are accessing these via HTTP 80, but internally they run on Tomcat 8080 (or whatever your tomcat port is). For most ...


5

Glassfish is an application server as it handles EJB requests (EJB Container) while Tomcat is a Web Container - it can't handle EJB components. So, what are the components of the application you plan to run. If your application uses Servlets and JSPs, then GlassFish is an overkill. If you have EJBs then you can't use Tomcat anyway. So, I think it starts with ...


5

you may want to try your questions over at stackoverflow.com. At my company the programming teams set up those application servers and then work with production support. We keep JBoss in our repository because of all the configuration changes and each server we deploy needs to be slightly modified. I've enjoyed playing with JBoss and the people in the ...


5

They're often the same, but technically an app server is not limited to HTTP requests, and is often behind a web server and provides "business logic" in the form of web service calls which are used to construct the actual resources requested by the end user. See this for more: http://www.javaworld.com/javaworld/javaqa/2002-08/01-qa-0823-appvswebserver.html ...


5

Using a domain account requires administration and protection of the account and password. Using the builtin NetworkService or LocalService identities has lower administrative effort and does not require protection of the service account password. The builtin identities have predefined permissions for some objects on the system and may be shared by ...


4

I usually install RKHunter, which scans for rootkits and does integrity checks of various important system binaries. It's in the standard repo, and will run daily from cron. It's not perfect, securitywise, but it's a low-effort item to add, and it provides a measure of protection.


4

Install logcheck, but tweak so that you never receive messages from regular events, otherwise you'll get in the habit of ignoring the emails. Check which processes are listening using netstat, and make sure nothing's running that doesn't need to run. Many daemons can be configured only to listen on the internal IP (or localhost) instead of all interfaces.


4

There are several files (two of them look like reliable sources) in your WAS-profile that you can check (I used the paths from my installation, which uses mostly the standard settings): {WAS-Profile-Path}\logs\AboutThisProfile.txt {WAS-Profile-Path}\config\cells{cellname}\nodes{nodename}\serverindex.xml And look for WC_adminhost_secure or WC_adminhost. ...


4

There is no really precise definition of these terms, but very roughly speaking: a web server is a program that serves content (HTML, images, etc) to browsers, i.e. to be read by humans a web service is a service that can be accessed via HTTP (the same protocol a web server uses), typically an API to be used by programs So the difference is the ...


4

You should take a look at PHP-FPM. It is a PHP FastCGI implementation that should let you separate the PHP to its own application server.


4

Q> What is the correct way for deploying an Java web app on Tomcat via the Admin / Mgmt interface and have it be the root application? A> Look at Tomcat 6: How to change the ROOT application Q> hosted on port 80? A> Change the relevant Connector property in conf/server.xml. Remember, running on port 80 will require root privileges, at least on Unix servers. ...


4

The difference really boils down to how the service will interact with other machines over the network (using Microsoft networking protocols). The "Network Service" is, effectively, an unprivileged user that authenticates as the computer's domain account when accessing remote resources. Assuming that your domain account is just a member of the "Users" group ...


3

Use separate partitions for various directories like /tmp or /var and mount them with nosuid, nodev and noexec if possible.


3

I heard that Glassfish is the fastest server if you scale up to a big environment. This does it by grizzly. Here are some performance stats.


3

Do what Can suggests... Nmap the host and disable all non-essential services. Use iptables if necessary.


3

Some firewall suggestions. Learn to use a firewall and the concepts of properly locking a box down. Changing default ports is largely a useless thing; proper application and firewall configuration are much more important. Both are in the Ubuntu repos: FireHOL has terrific documentation and very easy to learn syntax. I was able to set up a ...


3

How good is Glassfish at serving static content? Name-based vhosting? Redirects? I'm willing to bet that Apache is better at it all. If you're particularly interested in a small footprint frontend webserver, though, look at nginx instead of Apache.


3

One of the features of the Certificate Authority system is that things change. Roots expire, new roots come into existence, certificates are revoked, roots go bankrupt after compromises. An update mechanism really needs to be in place to handle these changes. There is a third option available, and that is to use a different CA that offers 2K certificates ...


3

There is no cheap answer to this, and nothing appropriate for a 5-PC office. If he thinks that doing this means he only has to buy 1 license for the software, he's incorrect. Any method of doing this is going to expensive, period. Citrix XenApp (formerly presentation server) was made for this, but you have to have good server-class hardware to run it on, ...


3

I think you find that it is very difficult to get a terminal server / VDI setup to perform well for those types of applications (AutoCAD, 3DMax). I suspect you will also find it very costly to get started on a TS/VDI setup for only 6 machines. You need a lot of server infrastructure to support either of those technologies. You can and possibly should ...


3

I wouldn't suggest relying on snapshots for this purpose. Depending on the version of VMware you have installed, you can clone an existing virtual machine or leverage the template functions of vCenter. Outside of that, I would just reinstall onto a new virtual machine if you have the access. If you don't have access to do this, check with the person/group ...


2

As well as other suggestions here I'll mention three that are obvious but perhaps worth mentioning for completeness: If you don't think you need a firewall, think again. ufw is simple but designed for Ubuntu and based on iptables Update the packages: as a minimum apply all the security patches Document what you've done to secure the server and why. Include ...


2

If you're going anywhere near the Internet with the server, install an intrusion detection system like snort.


2

After contacting IBM support, I learn the following: The registry backup command would only run on a box that has been declared (in the ClearCase Properties in the Control Panel menu) as a registry backup server. Consequently, it cannot be the existing registry server. So running the registry backup command from the server itself (as it's configure now in ...



Only top voted, non community-wiki answers of a minimum length are eligible