tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Bárbara Vieira <barbar...@di.uminho.pt>
Subject RE: Why use a Web Server over Tomcat?
Date Thu, 10 Jan 2008 14:39:13 GMT
Hi everyone!
David, imagine that you are developing a web application to provide services
like internet banking. What network architecture would you propose? How will
you implement a DMZ? Probably you put a firewall between Web Server and
Database Server!! Or not?

Regards,
Bárbara Vieira


-----Original Message-----
From: David Smith [mailto:dns4@cornell.edu] 
Sent: quarta-feira, 9 de Janeiro de 2008 18:35
To: Tomcat Users List
Subject: Re: Why use a Web Server over Tomcat?

In my CISSP training, we covered the possiblity of putting a web server 
in between two firewalls.  The outer one cleans the course junk out of 
the data stream like denial of service attacks, web server compromise 
attackes, malformed packets, as well as closing down server services 
that should be available to the company, but not the public.  The inner 
one is more fine grained possibly protecting company data assets from 
disclosure or blocking unapproved websites from being accessed by employees.

Just trying to say there is a business case for two firewalls -- it has 
more to do with protecting company assets than protecting the web server.

--David

Bárbara Vieira wrote:

>Alan and Johnny,
>I agree with Alan. I'm using the same scheme to save passwords in database,
>and SSL too.
>But, Johnny's answer help me understand some things. 
>Johnny, when you say:
>  
>
>>So in those organization Tomcat is probably behind the second internal
>>    
>>
>firewall 
>  
>
>>for staff to use as well.
>>    
>>
>What do you mean? If you have a Tomcat inside a DMZ, usually we have one
>firewall, that separates internet from intranet, i.e., the firewall filters
>requests that comes from de outside. Isn't that?
>
>Thanks, 
>Regards,
>Bárbara Vieira
> 
>
>-----Original Message-----
>From: Alan Chaney [mailto:alan@compulsivecreative.com] 
>Sent: quarta-feira, 9 de Janeiro de 2008 14:10
>To: Tomcat Users List
>Subject: Re: Why use a Web Server over Tomcat?
>
>
>  
>
>>One reason for doing this, is again not whether IIS or APACHE is better 
>>although APACHE on linux in the
>>hands of a guru is very good, its because Tomcat carries clear text 
>>passwords, so if a hacker did
>>get at the machine, they would probably see the Active X LDAP master 
>>password, 
>>    
>>
>
>I don't understand this comment at all. 'Passwords' in tomcat can be 
>managed by a whole host of authentication schemes. I use SSL to protect 
>access to the password on the net and MD5 encoded passwords in a 
>database for user authentication and access control. It depends entirely 
>upon how you configure your system.
>
>Regards
>
>Alan
>
>  
>
>>
>>---------------------------------------------------------------------
>>To start a new topic, e-mail: users@tomcat.apache.org
>>To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>>For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
>>
>>!DSPAM:4784031b130881839419991!
>>
>>    
>>
>
>---------------------------------------------------------------------
>To start a new topic, e-mail: users@tomcat.apache.org
>To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>For additional commands, e-mail: users-help@tomcat.apache.org
>
>
>
>
>---------------------------------------------------------------------
>To start a new topic, e-mail: users@tomcat.apache.org
>To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>For additional commands, e-mail: users-help@tomcat.apache.org
>
>  
>


---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org




---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org


Mime
View raw message