Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (nike.apache.org: local policy)
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Subject: RE: Protecting static resources in IIS
Date: Wed, 3 Nov 2010 09:12:41 -0000
Message-ID: 
 <6D8F0A4A19FB2A49815191AC1C2B128E09DC0056@UKEXCHANGE1.Europe.iSOFTGroup.co.uk>
In-Reply-To: 
 <99C8B2929B39C24493377AC7A121E21F99F87A6F3F@USEA-EXCH8.na.uis.unisys.com>
Thread-Topic: Protecting static resources in IIS
Thread-Index: 
 Act6rWLmlDNi5JXnQbmABBs9XCt0WAAARq/wAAHGksAAAPdD4AAArBlAAAAr6eAAAES+gAAeP/7g
References: <AANLkTinT6FjLRD5bDp0ghxhNE9RrCfsrSXQGxqVabV15@mail.gmail.com>
 <6D8F0A4A19FB2A49815191AC1C2B128E09DBFEDF@UKEXCHANGE1.Europe.iSOFTGroup.co.uk>
 <AANLkTimM8SN3_7kNxcQ1-QYuU1XpgxVtFe7pnp1oCo6i@mail.gmail.com>
 <6D8F0A4A19FB2A49815191AC1C2B128E09DBFF13@UKEXCHANGE1.Europe.iSOFTGroup.co.uk>
 <AANLkTinuw57QMaSUrWacqd2N8HNu+wzC+k7xFzt+DqiJ@mail.gmail.com>
 <7884876715451366394@unknownmsgid>
 <F5B31932A05D9541B5954AB1BACE575D049ED765@EXCHVS04.corp.jcp.com>
 <6D8F0A4A19FB2A49815191AC1C2B128E09DBFFE2@UKEXCHANGE1.Europe.iSOFTGroup.co.uk>
 <F5B31932A05D9541B5954AB1BACE575D049ED7AE@EXCHVS04.corp.jcp.com>
 <99C8B2929B39C24493377AC7A121E21F99F87A6ED5@USEA-EXCH8.na.uis.unisys.com>
 <F5B31932A05D9541B5954AB1BACE575D049ED7E7@EXCHVS04.corp.jcp.com>
 <99C8B2929B39C24493377AC7A121E21F99F87A6F3F@USEA-EXCH8.na.uis.unisys.com>
From: "Rob Gregory" <Rob.Gregory@ibsolutions.com>
To: "Tomcat Users List" <users@tomcat.apache.org>

Totally agree with Chuck, I would not recommend running a web server as
a root/system user.

> -----Original Message-----
> From: Caldarale, Charles R [mailto:Chuck.Caldarale@unisys.com]
> Sent: 02 November 2010 18:48
> To: Tomcat Users List
> Subject: RE: Protecting static resources in IIS
>=20
> > From: Richard G Curry [mailto:rgcurry@jcpenney.com]
> > Subject: RE: Protecting static resources in IIS
>=20
> > > > > From: Rob Gregory [mailto:Rob.Gregory@ibsolutions.com]
> > > > > Subject: RE: Protecting static resources in IIS
>=20
> > > > > Would that then result in having to run Tomcat/Apache/IIS as
> > > > > root/system rather than a restricted user?
>=20
> > > > Yes.
>=20
> > > That sounds like a really bad idea.
>=20
> > How so? What am I missing?
>=20
> Basic security philosophy, known as the principle of least privilege.
Running
> as root/system is like walking around with a "kick me" sign; just wait
till
> the hackers break into your IIS box running that way...
>=20
>  - Chuck
>=20
>=20
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE
PROPRIETARY
> MATERIAL and is thus for use only by the intended recipient. If you
received
> this in error, please contact the sender and delete the e-mail and its
> attachments from all computers.
>=20
>=20
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org