Tomcat Web Hosting Blog - Java, JSP, EJB, Hibernate

Chapter 14: Tomcat Security Enabling Creation of a Class Loader The following example shows how to give a specific Web application, yourWebApp, the capability to create a class loader: grant codeBase file:${catalina.home}/webapps/yourWebApp/WEB-INF/classes/- { permission java.lang.RuntimePermission createClassLoader ; }; Enabling JDBC Drivers to Open Socket Connections to Databases The following example shows how to allow all Web applications access to a specific database running on the host db.server.comon port 54321: grant codeBase file:${catalina.home}/webapps/- { permission java.net.SocketPermission db.server.com:54321 , connect ; }; Note that the preceding example allows all code across all of your Web applications to connect to db.server.com:54321. If this is too much of a security risk, the JDBC driver can be explicitly granted permission individually: grant codeBase file:${catalina.home}/webapps/webAppName/WEB-INF/lib/ mysql-connector-java-5.0.4-bin.jar { permission java.net.SocketPermission db.server.com:54321 , connect ; }; Sending E-Mail with JavaMail Sending e-mail requires that a Web application have access to port 25 on an SMTP server. The following example shows how to grant this permission to all classes in a Web application: grant codeBase file:${catalina.home}/webapps/myWebApp/WEB-INF/classes/- { permission java.net.SocketPermission mail.server.com:25 , connect ; }; Reading or Writing to Files Outside of the Web Application s Directory Earlier in this chapter, we discussed securing the file system. If the file system has been properly secured, the following grant can be used to give Web applications full access to the file system (and thus rely on the operating system to enforce permissions): grant { java.io.FilePermission <> , read,write,execute,delete ; }; While it may be tempting to use the Java Security Model in place of securing the file system via operating system permissions, such a tactic is unwise. Relying on the operating system provides an important extra layer of security in the event that the Java Virtual Machine itself becomes compromised and exploited. Additionally, in many configurations, it is likely that Tomcat is not the only exploitable network service on the server another good reason to utilize the operating system s security model, as Tomcat s security settings would not apply to the other services.

If you looking for unlimited one inclusive web hosting plan please check web hosting plan website.

This entry was posted on Tuesday, August 25th, 2009 at 6:22 pm and is filed under tomcat. You can follow any responses to this entry through the RSS 2.0 feed. Responses are currently closed, but you can trackback from your own site.