Good point -- one I did not consider as in my realm of reference I am in a secured zone --
no outside access. Makes a big difference.
_______________________________________________________________________________________
«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»
_______________________________________________________________________________________
Rick Curry
Common Services - Software Development
E2 - 066, MS 5210
972-431-9178 (Voice)
972-585-7585 (Pager)
To send a (short) Text Message to my Pager:
9725857585@page.metrocall.com
-----Original Message-----
From: Caldarale, Charles R [mailto:Chuck.Caldarale@unisys.com]
Sent: Tuesday, November 02, 2010 1:48 PM
To: Tomcat Users List
Subject: RE: Protecting static resources in IIS
> From: Richard G Curry [mailto:rgcurry@jcpenney.com]
> Subject: RE: Protecting static resources in IIS
> > > > From: Rob Gregory [mailto:Rob.Gregory@ibsolutions.com]
> > > > Subject: RE: Protecting static resources in IIS
> > > > Would that then result in having to run Tomcat/Apache/IIS as
> > > > root/system rather than a restricted user?
> > > Yes.
> > That sounds like a really bad idea.
> How so? What am I missing?
Basic security philosophy, known as the principle of least privilege. Running as root/system
is like walking around with a "kick me" sign; just wait till the hackers break into your IIS
box running that way...
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus
for use only by the intended recipient. If you received this in error, please contact the
sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential and/or privileged
material. If the reader of this message is not the intended recipient,
you are hereby notified that your access is unauthorized, and any review,
dissemination, distribution or copying of this message including any
attachments is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete the material from any
computer.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
|