NoozNooz42's questions

I've got a Debian Linux 64 bit dedicated server. The kernel has the grsec patch applied.

I'm mainly using this server to run Apache Tomcat (6.0.26, Java 6) and everything seems fine.

The only issue, is that when I start Tomcat, I get a few of these:

grsec: From xxx.xxx.xxx.xxx: Segmentation fault occurred at 00007fefe04e4000 in /home/t/jre1.6.0_20/bin/java[java:22403] uid/euid:1001/1001 gid/egid:1001/1001, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0
grsec: more alerts, logging disabled for 10 seconds

Then no error logs anymore. Everything is fine.

The kernel is:

Linux 2.6.32.2-xxxx-grs-ipv4-64 #1 SMP Tue Dec 29 14:41:12 UTC 2009 x86_64 GNU/Linux

And the webapp works fine.

So there are segmentation fault when Tomcat starts, but everything seems to works fine.

Is this concerning? Should I move to a non-grsec kernel?

This question is not about performance, nor about load-balancing, etc.

Which would be more secure: running Tomcat in standalone mode or running Tomcat behind apache?

The thing is, Tomcat is written in Java and hence it is pretty much immune to buffer overrun/overflow (unless a buffer overrun in a C-written lib used by Tomcat can be triggered, but they're rare [the last I remember was in zlib, many many moons ago] and one heck of a hack to actually exploit), which gets rid of a lot of potential exploits.

This page:

http://wiki.apache.org/tomcat/FAQ/Security

has this to say:

There have been no public cases of damage done to a company, organization, or individual due to a Tomcat security issue... there have been only theoretical vulnerabilities found. All of those were addressed even though there were no documented cases of actual exploitation of these vulnerabilities.

This, combined with the fact that buffer overrun/overflow are pretty much non-existent in Java, makes me believe that Tomcat in standalone mode is pretty secure.

In addition to that, I can install both Java and Tomcat on Linux without needing to be root. The only moment I need to be root is to set up a transparent port 8080 to port 80 forwarding (and 8443 to 443). Two iptables line as root, that's all root is needed for. (I don't know for Apache).

Apache is much more used than Tomcat and definitely does not have a security track record as good as Tomcat.

What would make Tomcat + Apache more secure?

What would make Tomcat + Apache less secure?

In short: which is more secure, Tomcat standalone or Tomcat with Apache? (remembering that performance aren't an issue here)

Some background on the subject, here on the Tomcat mailing list in 2007:

http://mail-archives.apache.org/mod_mbox/tomcat-users/200710.mbox/%[email protected]%3E

Short answer: if you don't see a compelling reason to actively put an httpd in front of Tomcat, there most probably is none.

the claim one can sometimes read that you should always put an httpd in front of Tomcat is complete nonsense IMO. The opposite is true.

How do you allow a user to log in using "su - user" but prevent the user from login in using SSH?

I tried to set the shell to /bin/false but the when I try to su it doesn't work.

Are there several ways to only allow logins by su?

Is SSH's AllowUser the way to go? (how would I do this if it's the way to go)

I want to know if you have any tips as to how to strengthen the security of a non-root install of Tomcat in standalone mode once Tomcat is already installed in a non-root account, in standalone mode.

I precise this because, for example, I'm not at all interested by the answers given here (because both Java and Tomcat requires root priviledges there to be installed and I've got zero interest in running jsvc):

What steps should I take to secure Tomcat 6.x?

So far, here's what I've done for my non-root standalone Tomcat 6 install:

• download and install the JRE .bin provided by Oracle/Sun (no need to be root here) (no need for a full JDK anymore right seen that Jasper [Tomcat's JSP engine] has its own compiler now right?)

• download and tar -xzf tomcat 6 (no need to be root here)

• set up transparent port-forwarding (must be root here)

Note that my distribution is a Debian one and I have exactly zero interest in downloading Debian package / backports / whatever... Because, once again, I DO NOT want to need to be root to install Java & Tomcat. The only moment I needed to be root was to configure the firewall to transparently do the port forwarding 80 <--> 8080 and 443 <--> 8443.

I then deleted all the default webapps but one:

cd ~/apache-tomcat-6.0.26/webapps
rm -rf docs
rm -rf examples/
rm -rf manager/ 
rm -rf ROOT/

What about the directory ~/apache-tomcat-6.0.26/webapps/host-manager, do I need it or can I delete it?

I then commented this:

So, once I've installed Tomcat standalone in a non-root account (and taken into account that I don't want to enter the root password anymore and that I don't plan to install the whole Apache shebang), what more can I do?

Are there other things I can disable? (how?)