Return-Path: X-Original-To: apmail-tomcat-users-archive@www.apache.org Delivered-To: apmail-tomcat-users-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 762FC945B for ; Tue, 8 Nov 2011 13:16:13 +0000 (UTC) Received: (qmail 7754 invoked by uid 500); 8 Nov 2011 13:16:10 -0000 Delivered-To: apmail-tomcat-users-archive@tomcat.apache.org Received: (qmail 7707 invoked by uid 500); 8 Nov 2011 13:16:09 -0000 Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: "Tomcat Users List" Delivered-To: mailing list users@tomcat.apache.org Received: (qmail 7698 invoked by uid 99); 8 Nov 2011 13:16:09 -0000 Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 08 Nov 2011 13:16:09 +0000 X-ASF-Spam-Status: No, hits=-0.6 required=5.0 tests=FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM,RCVD_IN_DNSWL_LOW,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (nike.apache.org: domain of phracek2@gmail.com designates 209.85.216.45 as permitted sender) Received: from [209.85.216.45] (HELO mail-qw0-f45.google.com) (209.85.216.45) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 08 Nov 2011 13:16:03 +0000 Received: by qadz3 with SMTP id z3so524465qad.18 for ; Tue, 08 Nov 2011 05:15:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type:content-transfer-encoding; bh=BELSZfArAco7IFs3DBCwcCIli1IfD69C6Oi3FrnmQYg=; b=l4yO8q0HMulgQyegJfxqTU41e4CVYhRgVDKNkNa9zrKFlCSswR2bF3NQK/iIvo918e 5TjttDaLvOd6Q3+MlRlnWGcURSUqY17UpnlTDAWM7ztfmX5So8cs1Jjodl4UMXK6Acl1 Vr6DaVV3Tan53jfDsm2Btn2Uefhp8wYWP0NQY= MIME-Version: 1.0 Received: by 10.224.212.198 with SMTP id gt6mr14722736qab.82.1320758142917; Tue, 08 Nov 2011 05:15:42 -0800 (PST) Received: by 10.224.20.74 with HTTP; Tue, 8 Nov 2011 05:15:42 -0800 (PST) In-Reply-To: References: <4EB7C132.5040202@ice-sa.com> Date: Tue, 8 Nov 2011 14:15:42 +0100 Message-ID: Subject: Re: Catalina.policy file for security option From: Petr Hracek To: Tomcat Users List Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Virus-Checked: Checked by ClamAV on apache.org When I have set CATALINA_OPTS to: linux:/var/log/tomcat5/base # echo $CATALINA_OPTS -Djava.security.debug=3Dall linux:/var/log/tomcat5/base # in log I see: domain 1 ProtectionDomain CodeSource=3DCodeSource, url=3Dfile:/usr/share/tomcat5/bin/bootstrap.jar, ClassLoader=3Dsun.misc.Launcher$AppClassLoader@8e208e2 Permissions: static: java.security.Permissions@8930893 ( (java.io.FilePermission /usr/share/tomcat5/bin/bootstrap.jar read) (java.lang.RuntimePermission exitVM) ) Dne 8. listopadu 2011 13:51 Petr Hracek napsal(a): > Yes the tomcat should be run as a back-end server (AJP) with apache2-2.2.= 21. > I have add to the catalina.policy following permission: > =C2=A0 =C2=A0 =C2=A0 =C2=A0permission javax.management.MBeanServerPermiss= ion "createMBeanServer"; > =C2=A0 =C2=A0 =C2=A0 =C2=A0permission javax.management.MBeamPermission > "com.javamonitor.mbeans.*","*"; > =C2=A0 =C2=A0 =C2=A0 =C2=A0permission javax.management.MBeanTrustPermissi= on "register"; > =C2=A0 =C2=A0 =C2=A0 =C2=A0permission javax.management.MBeanServerPermiss= ion "findMBeanServer"; > =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.net.SocketPermission "java-mon= itor.com:80", "connect"; > =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.net.SocketPermission "java-mon= itor.com:80", "resolve"; > > In the log of catalina.out I see: > log4j:WARN No appenders could be found for logger > (org.apache.catalina.startup.Embedded). > log4j:WARN Please initialize the log4j system properly. > > But as in ps -ef | grep java and lsof -i | grep java I did not see any > 8009 and 8005 port or even that tomcat5 is not starting. > > Where could be a problem? > > Dne 7. listopadu 2011 12:29 Andr=C3=A9 Warnier napsal(a): >> Petr Hracek wrote: >>> >>> Dear tomcat users, >>> >>> I have try to configure my really old tomcat5 configuration (for using >>> -security). >>> but tomcat is not running. >> >> Petr, >> can you be a bit more specific ? what is not running ? does it start ? d= oes >> it crash after starting ? is it just not answering requests ? are there >> error messages anywhere ? >> >> On my system tomcat5 is run only as servlet >>> >>> engine and not as web server. >>> >> Do you mean for example that it runs as a back-end server (through AJP >> e.g.), with a front-end webserver serving all static content ? >> >> >> >>> Do you have any example catalina.policy file? >>> My catalina.policy file is: >>> // =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D SYSTEM CODE PERMISSIONS >>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>> >>> >>> // These permissions apply to javac >>> grant codeBase "file:${java.home}/lib/-" { >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.security.AllPermission; >>> }; >>> >>> // These permissions apply to all shared system extensions >>> grant codeBase "file:${java.home}/jre/lib/ext/-" { >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.security.AllPermission; >>> }; >>> >>> // These permissions apply to javac when ${java.home] points at >>> $JAVA_HOME/jre >>> grant codeBase "file:${java.home}/../lib/-" { >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.security.AllPermission; >>> }; >>> >>> // These permissions apply to all shared system extensions when >>> // ${java.home} points at $JAVA_HOME/jre >>> grant codeBase "file:${java.home}/lib/ext/-" { >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.security.AllPermission; >>> }; >>> // =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D CATALINA CODE PERMISSIONS >>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>> >>> >>> // These permissions apply to the launcher code >>> grant codeBase "file:${catalina.home}/bin/commons-launcher.jar" { >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.security.AllPermission; >>> }; >>> >>> // These permissions apply to the daemon code >>> grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" { >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.security.AllPermission; >>> }; >>> >>> // These permissions apply to the commons-logging API >>> grant codeBase "file:${catalina.home}/bin/commons-logging-api-1.1.1.jar= " { >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.security.AllPermission; >>> }; >>> >>> // These permissions apply to the server startup code >>> grant codeBase "file:${catalina.home}/bin/bootstrap.jar" { >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.security.AllPermission; >>> }; >>> >>> // These permissions apply to the JMX server >>> grant codeBase "file:${catalina.home}/bin/jmx.jar" { >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.security.AllPermission; >>> }; >>> >>> // These permissions apply to JULI >>> grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" { >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.util.PropertyPermission >>> "java.util.logging.config.class", "read"; >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.util.PropertyPermission >>> "java.util.logging.config.file", "read"; >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.io.FilePermission >>> "${java.home}${file.separator}lib${file.separator}logging.properties", >>> "read"; >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.lang.RuntimePermission "shut= downHooks"; >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.io.FilePermission >>> >>> "${catalina.base}${file.separator}conf${file.separator}logging.properti= es", >>> "read"; >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.util.PropertyPermission "cat= alina.base", "read"; >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.util.logging.LoggingPermissi= on "control"; >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.io.FilePermission >>> "${catalina.base}${file.separator}logs", "read, write"; >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.io.FilePermission >>> "${catalina.base}${file.separator}logs${file.separator}*", "read, >>> write"; >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.lang.RuntimePermission "getC= lassLoader"; >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0// To enable per context logging configurati= on, permit read >>> access to the appropriate file. >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0// Be sure that the logging configuration is= secure before >>> enabling such access >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0// eg for the examples web application: >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0// permission java.io.FilePermission >>> >>> "${catalina.base}${file.separator}webapps${file.separator}examples${fil= e.separator}WEB-INF${file.separator}classes${file.separator}logging.propert= ies", >>> "read"; >>> }; >>> >>> // These permissions apply to the servlet API classes >>> // and those that are shared across all class loaders >>> // located in the "common" directory >>> grant codeBase "file:${catalina.home}/common/-" { >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.security.AllPermission; >>> }; >>> >>> // These permissions apply to the container's core code, plus any >>> additional >>> // libraries installed in the "server" directory >>> grant codeBase "file:${catalina.home}/server/-" { >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.security.AllPermission; >>> }; >>> >>> // The permissions granted to the balancer WEB-INF/classes and >>> WEB-INF/lib directory >>> grant codeBase "file:${catalina.home}/webapps/balancer/-" { >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.lang.RuntimePermission >>> "accessClassInPackage.org.apache.tomcat.util.digester"; >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0permission java.lang.RuntimePermission >>> "accessClassInPackage.org.apache.tomcat.util.digester.*"; >>> }; >>> // =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D WEB APPLICATION PERMISSIONS >>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>> >>> >>> // These permissions are granted by default to all web applications >>> // In addition, a web application will be given a read FilePermission >>> // and JndiPermission for all files and directories in its document roo= t. >>> grant { >>> =C2=A0 =C2=A0// Required for JNDI lookup of named JDBC DataSource's and >>> =C2=A0 =C2=A0// javamail named MimePart DataSource used to send mail >>> =C2=A0 =C2=A0permission java.util.PropertyPermission "java.home", "read= "; >>> =C2=A0 =C2=A0permission java.util.PropertyPermission "java.naming.*", "= read"; >>> =C2=A0 =C2=A0permission java.util.PropertyPermission "javax.sql.*", "re= ad"; >>> >>> =C2=A0 =C2=A0// OS Specific properties to allow read access >>> =C2=A0 =C2=A0permission java.util.PropertyPermission "os.name", "read"; >>> =C2=A0 =C2=A0permission java.util.PropertyPermission "os.version", "rea= d"; >>> =C2=A0 =C2=A0permission java.util.PropertyPermission "os.arch", "read"; >>> =C2=A0 =C2=A0permission java.util.PropertyPermission "file.separator", = "read"; >>> =C2=A0 =C2=A0permission java.util.PropertyPermission "path.separator", = "read"; >>> =C2=A0 =C2=A0permission java.util.PropertyPermission "line.separator", = "read"; >>> >>> =C2=A0 =C2=A0// JVM properties to allow read access >>> =C2=A0 =C2=A0permission java.util.PropertyPermission "java.version", "r= ead"; >>> =C2=A0 =C2=A0permission java.util.PropertyPermission "java.vendor", "re= ad"; >>> =C2=A0 =C2=A0permission java.util.PropertyPermission "java.vendor.url",= "read"; >>> =C2=A0 =C2=A0permission java.util.PropertyPermission "java.class.versio= n", "read"; >>> =C2=A0 =C2=A0permission java.util.PropertyPermission >>> "java.specification.version", "read"; >>> =C2=A0 =C2=A0permission java.util.PropertyPermission "java.specificatio= n.vendor", >>> "read"; >>> =C2=A0 =C2=A0permission java.util.PropertyPermission "java.specificatio= n.name", >>> "read"; >>> >>> =C2=A0 =C2=A0permission java.util.PropertyPermission >>> "java.vm.specification.version", "read"; >>> =C2=A0 =C2=A0permission java.util.PropertyPermission >>> "java.vm.specification.vendor", "read"; >>> =C2=A0 =C2=A0permission java.util.PropertyPermission >>> "java.vm.specification.name", "read"; >>> =C2=A0 =C2=A0permission java.util.PropertyPermission "java.vm.version",= "read"; >>> =C2=A0 =C2=A0permission java.util.PropertyPermission "java.vm.vendor", = "read"; >>> =C2=A0 =C2=A0permission java.util.PropertyPermission "java.vm.name", "r= ead"; >>> >>> =C2=A0 =C2=A0// Required for OpenJMX >>> =C2=A0 =C2=A0permission java.lang.RuntimePermission "getAttribute"; >>> >>> =C2=A0 =C2=A0// Allow read of JAXP compliant XML parser debug >>> =C2=A0 =C2=A0permission java.util.PropertyPermission "jaxp.debug", "rea= d"; >>> >>> =C2=A0 =C2=A0// Precompiled JSPs need access to this package. >>> =C2=A0 =C2=A0permission java.lang.RuntimePermission >>> "accessClassInPackage.org.apache.jasper.runtime"; >>> =C2=A0 =C2=A0permission java.lang.RuntimePermission >>> "accessClassInPackage.org.apache.jasper.runtime.*"; >>> >>> =C2=A0 =C2=A0// Precompiled JSPs need access to this system property. >>> =C2=A0 =C2=A0permission java.util.PropertyPermission >>> "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read"; >>> }; >>> >>> >>> My server.xml configuration file is: >>> >>> >>> >>> >>> >>> =C2=A0 >>> =C2=A0>> /> >>> =C2=A0>> className=3D"org.apache.catalina.mbeans.GlobalResourcesLifecycleListene= r" >>> /> >>> =C2=A0>> className=3D"org.apache.catalina.storeconfig.StoreConfigLifecycleListen= er"/> >>> >>> =C2=A0 >>> =C2=A0 >>> >>> =C2=A0 =C2=A0 >>> =C2=A0 =C2=A0 >>> >>> =C2=A0 =C2=A0 >>> =C2=A0 =C2=A0>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0type=3D"org.apache.cata= lina.UserDatabase" >>> =C2=A0 =C2=A0 =C2=A0 description=3D"User database that can be updated a= nd saved" >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 factory=3D"org.apache.catalina.users= .MemoryUserDatabaseFactory" >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pathname=3D"conf/tomcat-users.xml" /> >>> >>> =C2=A0 >>> >>> =C2=A0 >>> =C2=A0 >>> >>> =C2=A0 =C2=A0 >>> =C2=A0 =C2=A0>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 maxThreads=3D"150" min= SpareThreads=3D"25" maxSpareThreads=3D"75" >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 enableLookups=3D"false= " redirectPort=3D"8443" acceptCount=3D"100" >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 connectionTimeout=3D"2= 0000" disableUploadTimeout=3D"true" /> >>> =C2=A0 =C2=A0 >>> >>> =C2=A0 =C2=A0 >>> =C2=A0 =C2=A0>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 enableLookups=3D"false= " redirectPort=3D"8443" >>> protocol=3D"AJP/1.3" address=3D"127.0.0.1" /> >>> >>> =C2=A0 =C2=A0 >>> =C2=A0 =C2=A0 >>> =C2=A0 =C2=A0 >>> >>> =C2=A0 =C2=A0 =C2=A0>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 resourceName=3D"UserDatabase"= /> >>> >>> =C2=A0 =C2=A0 =C2=A0 >>> =C2=A0 =C2=A0 =C2=A0>> =C2=A0 =C2=A0 =C2=A0 unpackWARs=3D"true" autoDeploy=3D"true" >>> =C2=A0 =C2=A0 =C2=A0 xmlValidation=3D"false" xmlNamespaceAware=3D"false= "> >>> >>> >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 >>> >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 >>> =C2=A0 =C2=A0 =C2=A0 >>> >>> =C2=A0 =C2=A0 >>> >>> =C2=A0 >>> >>> >>> >>> Thank you in advance. >>> If any logs will be need I can provide of course. >>> >> >> >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org >> For additional commands, e-mail: users-help@tomcat.apache.org >> >> > > > > -- > Best Regards / S pozdravem > Petr Hracek > --=20 Best Regards / S pozdravem Petr Hracek --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org For additional commands, e-mail: users-help@tomcat.apache.org