Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (herse.apache.org: domain of p.stavrinides@albourne.com
 designates 83.244.142.182 as permitted sender)
Message-ID: <46A85265.7020409@albourne.com>
Date: Thu, 26 Jul 2007 10:51:01 +0300
From: Peter Stavrinides <p.stavrinides@albourne.com>
User-Agent: Thunderbird 1.5.0.12 (X11/20070604)
MIME-Version: 1.0
To: Tomcat Users List <users@tomcat.apache.org>
Subject: Tomcat 5 and 6 Security advise
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Hi all,

I need some advice with regards to Tomcat security, my company is not 
convinced about Tomcat's security, I work for a financial institution so 
you might understand their paranoia.

My question is how best to secure a Java servlet that runs on Tomcat. 
Requests are routed through front end servers running Apache on separate 
physical machines. Should I configure in addition an Apache server 
locally or is Tomcat okay without it, my feeling is that this is not 
necessary.

Tomcat uses a JDBC realm to connect to a database for authentication, we 
use SSL and the machines are pretty well locked down. Is there anything 
else that should be considered? Does Apache offer something extra so 
that Tomcat should run with its own Apache web server bearing in mind we 
use only Java.

Thanks for your help,
Peter


---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org