Apache / Tomcat5.5? 1

[pinkpanther56]

Hi all

We have been required to use some software at our college and since it has been installed a new service has appeared called Tomcat and a folder called Tomcat5.5\webapps.

Does this mean that the software has installed an Apach web server?

Using Windows 2003 server with SP1.

Thanks.

 

[pinkpanther56]

Oh and also a PostgreSQL Database Server appears to of been installed.

 

[feherke]

Hi

Not necessary. Tomcat is a servlet container and can work alone. But sometimes is put to work under an Apache.

There is no way to give you exact answer for that short question.

Feherke.

http://rootshell.be/~feherke/

 

[pinkpanther56]

Ah ok i'd like to find out as i don't want to be running a box with an unpatched web server. Can you tell me how to find out if Apach is running on this box should it just show up in add remove programs? (I can't look at the mo but i'd like to check next time i'm looking at the box)

Thanks.

 

[feherke]

Hi

Sorry, never seen Apache on Windows. I would say that yes, it should be listed at Add/Remove Programs.

Feherke.

http://rootshell.be/~feherke/

 

[pinkpanther56]

Ok cheers i'll take a look thanks for the advice.

 

[NullTerminator]

Apache on windows should show up in the "services" applet. Do start | run | services.msc and see if Apache 2 is listed.

Also "netstat -a | findstr http" will 'hit' if apache is running.

Apache must be configured to forward *.jsp and servlet requests to Tomcat. Tomcat's builtin webserver normally listens on 8080 instead of 80.

Jeb
\0

 

[pinkpanther56]

I see this in the description of the Tomcat service

"Apache Tomcat Server -

http://jakarta.apache.org/tomcat"

and it's listening on port 8443.

 

[NullTerminator]

The tomcat webserver is less robust than Apache. No ssl support, not much in the way of performance enhancements, no addins like mod_rewrite, little or no security.

You can use TaskManager | Processes tab to see if a true Apache.exe is running or not. If apache is present there will also be an httpd.conf file. If Apache is forwarding to Tomcat, there will be directive in the conf file specifying the connector parameters.

8443 is the default SSL port for Tomcat. It may or may not be actually responding to SSL. %tomcat_home%\conf\server.xml will tell you more

8080 is the default http port for Tomcat. Try opening a browser to each of these. It is much safer to put up apache as a front end for tomcat. More efficient as well since tomcat does not do well on static content. Tomcat is not very secure. (The admin password is stored in clear text in a conf file.)

Hope this helps rather than confuse
Jeb
\0

 

[pinkpanther56]

Yes i can see now that is has just installed the tomcat service itself.

Any pointers on how to keep it upto date and secure?

Which conf file holds the admin password?

Thanks.

 

[NullTerminator]

%tomcat_home%\conf\tomcat-users.xml

Best way to secure it is to run it in a "chroot jail"

Keep it up to date by monitoring the mailing list found here

http://tomcat.apache.org/whichversion.html

or here

http://tomcat.apache.org/lists.html

jeb

 

[pinkpanther56]

Ok thanks for the tips. It seems to be a pretty poor idea to store the passwords in plain text.