Mailing-List: contact tomcat-user-help@jakarta.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <tomcat-user@jakarta.apache.org>
Message-ID: <3FA686AD.7090804@joedog.org>
Date: Mon, 03 Nov 2003 11:47:41 -0500
From: Tim Funk <funkman@joedog.org>
Organization: Human being
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US;
 rv:1.4) Gecko/20030624
MIME-Version: 1.0
To: Tomcat Users List <tomcat-user@jakarta.apache.org>
Subject: Re: Deploying TOMCAT on live production server
References: <Sea1-DAV34VUNfv7W120000c4c9@hotmail.com>
In-Reply-To: <Sea1-DAV34VUNfv7W120000c4c9@hotmail.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

It depends. One would argue that tomcat by itself is more secure because
1) Its only one thing to defend
2) Don't need to worry about any apache exploits

OTOH
1) Apache has been hardened - its exploits are rare and when exposed are 
quickly fixed. (Tomcat's eploits are also quickly fixed too)
2) Apache can act as a barrier to prevent exploits from happening in tomcat 
(or exploits written into webapps)

IOW, different strokes for different folks.

-Tim

Steve Jenkins wrote:

> Thanks to one and all for their responses, particularly for the URL:
> http://jakarta.apache.org/tomcat/faq/connectors.html#integrate
> My final question is - is deploying TOMCAT on its' own secure enough? Or is
> deploying just Apache secure enough?


---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org