php-java-bridge-users — PHP/Java Bridge mailing list

Re: [Php-java-bridge-users] Securing PHP/Java Bridge

[<php...@li...>]

Enviado desde mi BlackBerry® soportado por CNT

-----Original Message-----
From: php...@li...
Date: Fri, 7 Sep 2012 23:55:03 
To: <php...@li...>
Reply-To: php...@li...
Subject: Re: [Php-java-bridge-users] Securing PHP/Java Bridge

You can secure the back end using basic auth and send something like

   "Authorization: Basic "
   base64_encode(user.":".pass)

but this won't solve the other problems (files, all apps running in shared
memory).
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
php-java-bridge-users mailing list
php...@li...
https://lists.sourceforge.net/lists/listinfo/php-java-bridge-users

Re: [Php-java-bridge-users] Securing PHP/Java Bridge

[<php...@li...>]

You can secure the back end using basic auth and send something like

   "Authorization: Basic "
   base64_encode(user.":".pass)

but this won't solve the other problems (files, all apps running in shared
memory).

Re: [Php-java-bridge-users] Securing PHP/Java Bridge

[<php...@li...>]

Thanks for your responses. Yes, it's a shared host, so it's not especially
secure to begin with, but a service that lets all and sundry execute any
Java code they desire is one more gaping hole I'd prefer not to have open.

Am I correct that there's no support for authentication within the client
in Java.inc? If so, can anybody shed any light on why it's not supported?
(i.e. is it more complicated to implement than I'm imagining? Is the
back-end communication not happening over HTTP? Did it just never occur to
anybody that somebody might want this feature?) In other words, if I decide
to try modifying the client to support basic authentication, will I live to
regret it? :)

Thanks again,
-Jon


On Fri, Sep 7, 2012 at 3:46 PM, <php...@li...
> wrote:

> On Fri, Sep 7, 2012 at 4:33 PM, <
> php...@li...
> > wrote:
>
> > If you install and update apache (or any other http server) from your
> linux
> > distribution (redhat or debian) you should be relatively save.
> >
>
> he said he´s running a shared hosting account,quote: "this still allows
> everybody on my shared hosting server..."
>
> FC
> --
> During times of Universal Deceit, telling the truth becomes a revolutionary
> act
> Durante épocas de Engaño Universal, decir la verdad se convierte en un Acto
> Revolucionario
> - George Orwell
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> php-java-bridge-users mailing list
> php...@li...
> https://lists.sourceforge.net/lists/listinfo/php-java-bridge-users
>

Re: [Php-java-bridge-users] Securing PHP/Java Bridge

[<php...@li...>]

On Fri, Sep 7, 2012 at 4:33 PM, <php...@li...
> wrote:

> If you install and update apache (or any other http server) from your linux
> distribution (redhat or debian) you should be relatively save.
>

he said he´s running a shared hosting account,quote: "this still allows
everybody on my shared hosting server..."

FC
-- 
During times of Universal Deceit, telling the truth becomes a revolutionary
act
Durante épocas de Engaño Universal, decir la verdad se convierte en un Acto
Revolucionario
- George Orwell

Re: [Php-java-bridge-users] Securing PHP/Java Bridge

[<php...@li...>]

Hi again. Sorry, I misunderstood you post. There's no resonable way to
sandbox your application. In general Java's security manager is the wrong
path, but it might work for your specific application. You might want to
implement your own xen based solution instead.

Re: [Php-java-bridge-users] Securing PHP/Java Bridge

[<php...@li...>]

Use Apache as a frint end and jee server as a back end and block all access
to the jee port except from localhost.

If you install and update apache (or any other http server) from your linux
distribution (redhat or debian) you should be relatively save.

[Php-java-bridge-users] Securing PHP/Java Bridge

[<php...@li...>]

Hello all,

I'm in the process of deploying an application which uses PHP/Java Bridge,
and I'm having some difficulty figuring out how to secure the bridge
against unauthorized usage. I've configured Tomcat to block access to the
servelet except from localhost, but unless I'm mistaken, this still allows
everybody on my shared hosting server to run arbitrary Java code in my
container (reading or writing any of my files, etc.). This is certainly not
ideal.

I have followed the instructions to run P/JB with Tomcat's security manager
(http://php-java-bridge.sourceforge.net/pjb/FAQ.html#tomcat-security), but
this appears to simply bypass the security manager altogether, making it
something of a non-solution.

I would like to do one or ideally both of the following:

1. Run PHP/JavaBridge with a security manager so that I can prevent it from
accessing files or directories not specifically required by my application.
2. Require authentication (e.g. basic HTTP authentication) when connecting
to the PHP/Java Bridge servelet (presumably I could set this up in Tomcat,
but I don't see any way to perform the authentication on the client end
from my PHP application).

Any pointers would be appreciated.

Thank you!
-Jon

Re: [Php-java-bridge-users] R: mysterious error(s)

[<php...@li...>]

I thought so.

If you don't want to use a jee (e.g. tomcat, glassfish,jetty...) back end,
you're on your own.

Please see FAQ and install document on php-java-bridge.sf.net for details.

[Php-java-bridge-users] R: mysterious error(s)

[<php...@li...>]

Thanks for your answer.
I'm not using Tomcat though, but directly calling java classes.
I wonder if this could mean that a java class is for some reason not responding..
Thanks again,
A




--- Gio 6/9/12, php...@li... <php...@li...> ha scritto:

> Da: php...@li... <php...@li...>
> Oggetto: [Php-java-bridge-users] mysterious error(s)
> A: php...@li...
> Data: Giovedì 6 settembre 2012, 15:18
> Hello,
> I get this error message in the Apache error log, and I
> cannot understand what's causing it.
> 
> Could somebody help please? Or at least point me to the
> right direction :)
> 
> 
> [Thu Sep 06 16:45:13 2012] [error] [client 131.152.227.94]
> PHP Notice:  fwrite() [<a
> href='function.fwrite'>function.fwrite</a>]: send
> of 193 bytes failed with errno=32 Broken pipe in
> /import/wnz/home/mirz/libraries/php/Java.inc on line 652,
> referer: http://www.clipz.unibas.ch/index.php?r=tools%2Falignment%2FregionalAlignment&strand=%2B&orgId=7&yt0=Show+genome+browser
> 
> Java.inc looks like this:
> 
> 648:   $res .= "\r\n";
> 649:   $res .= "\177";
> 650:   $res .= $compatibility;
> 651:   $res .= $data;
> 652:   $count = fwrite($socket, $res) or
> $this->shutdownBrokenConnection("Broken connection
> handle");
> 653:   fflush($socket) or
> $this->shutdownBrokenConnection("Broken connection
> handle");
> 654:   return $count;}
> 655:   function read($size)
> {if(is_null($this->headers)) $this->parseHeaders();
> 656:   $data = fread($this->socket,
> $this->headers['content_length']);
> 
> 
> Another problem I get is that in a certain page I have this
> error:
> Error 500
> Undefined index: content_length
> Which I strongly suspect that it's the same "content_length"
> of line 656..
> 
> 
> 
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's
> security and 
> threat landscape has changed and how IT managers can
> respond. Discussions 
> will include endpoint security, mobile security and the
> latest in malware 
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> php-java-bridge-users mailing list
> php...@li...
> https://lists.sourceforge.net/lists/listinfo/php-java-bridge-users
> 

Re: [Php-java-bridge-users] mysterious error(s)

[<php...@li...>]

Your tomcat web app has crashed (out of memory, stack overflow or
something). Please check the Tomcat log for details.

[Php-java-bridge-users] mysterious error(s)

[<php...@li...>]

Hello,
I get this error message in the Apache error log, and I cannot understand what's causing it.

Could somebody help please? Or at least point me to the right direction :)


[Thu Sep 06 16:45:13 2012] [error] [client 131.152.227.94] PHP Notice:  fwrite() [<a href='function.fwrite'>function.fwrite</a>]: send of 193 bytes failed with errno=32 Broken pipe in /import/wnz/home/mirz/libraries/php/Java.inc on line 652, referer: http://www.clipz.unibas.ch/index.php?r=tools%2Falignment%2FregionalAlignment&strand=%2B&orgId=7&yt0=Show+genome+browser

Java.inc looks like this:

648:   $res .= "\r\n";
649:   $res .= "\177";
650:   $res .= $compatibility;
651:   $res .= $data;
652:   $count = fwrite($socket, $res) or $this->shutdownBrokenConnection("Broken connection handle");
653:   fflush($socket) or $this->shutdownBrokenConnection("Broken connection handle");
654:   return $count;}
655:   function read($size) {if(is_null($this->headers)) $this->parseHeaders();
656:   $data = fread($this->socket, $this->headers['content_length']);


Another problem I get is that in a certain page I have this error:
Error 500
Undefined index: content_length
Which I strongly suspect that it's the same "content_length" of line 656..

[Php-java-bridge-users] AUTO: Jon Rush/Rochester/IBM is out of the office. (returning 09/04/2012)

[<php...@li...>]

I am out of the office until 09/04/2012.




Note: This is an automated response to your message  "Re:
[Php-java-bridge-users] Trouble installing typo3" sent on 08/31/2012
12:05:02 PM.

This is the only notification you will receive while this person is away.

Re: [Php-java-bridge-users] Trouble installing typo3

[<php...@li...>]

> The INSTALL.J2EE suggest that you just drop the war and that's it.

Yes, exactly. If you have downloaded the "original" software it will just
work. Please see the install section on http://php-java-bridge.sf.net

Common errors are to install the debian/ubuntu patched tomcat or the
windows php installer package. Both packages are entirely broken.

Please follow the instructions from the online install document. It will
work.

Re: [Php-java-bridge-users] Trouble installing typo3

[<php...@li...>]

That is why I uploaded it separately and ran it for testing my php
server configuration.

But still, it runs under Tomcat included in JavaBridge.war, but not
under the existing Tomcat installation.
Do I need to include the php-fastcgi executable in some PATH variable?
Do I need to setup a different port in some config file?

The INSTALL.J2EE suggest that you just drop the war and that's it. But it's not,
and I have no clue what to do.

Thanks,
Michael



2012/8/30  <php...@li...>:
> There is no JavaBridge.war in the template download...
>
> And the test backend youve started shadows tomcat. But I am sure you've
> already noticed that.
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> php-java-bridge-users mailing list
> php...@li...
> https://lists.sourceforge.net/lists/listinfo/php-java-bridge-users

Re: [Php-java-bridge-users] Trouble installing typo3

[<php...@li...>]

There is no JavaBridge.war in the template download...

And the test backend youve started shadows tomcat. But I am sure you've
already noticed that.

[Php-java-bridge-users] AUTO: Charles Shaffer is out of the office (returning 09/04/2012)

[<php...@li...>]

I am out of the office until 09/04/2012.




Note: This is an automated response to your message  "Re:
[Php-java-bridge-users] Trouble installing typo3" sent on 08/30/2012
1:59:09 AM.

This is the only notification you will receive while this person is away.

Re: [Php-java-bridge-users] Trouble installing typo3

[<php...@li...>]

I did so.
Running "java -classpath JavaBridge.war TestInstallation" produces
RESULT.hmtl, and everything seems fine.

Now calling test.php via Tomcat (embedded in webapp based on
JavaBridgeTemplate.war) gives the following error:
javax.servlet.ServletException:
php.java.bridge.http.FCGIConnectException: Could not connect to server

I browsed the archives, and someone could solve it by waiting some
time for the pool to be initiated.
Do I get something wrong? Does fast-cgi needs to run as daemon?

Thanks,
Michael

2012/8/29  <php...@li...>:
> JavaProxy.php sounds as if you set include_java. Try without it.
>
> i.e. use JavaBridgeTemplate.war download instead.
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> php-java-bridge-users mailing list
> php...@li...
> https://lists.sourceforge.net/lists/listinfo/php-java-bridge-users

Re: [Php-java-bridge-users] Trouble installing typo3

[<php...@li...>]

JavaProxy.php sounds as if you set include_java. Try without it.

i.e. use JavaBridgeTemplate.war download instead.

[Php-java-bridge-users] Trouble installing typo3

[<php...@li...>]

I try installing typo3 on tomcat using php 5.3 without much success yet.

Executing the install scripts fails, and when calling the typo3 index
page the following error comes up:
Cannot find tslib/. Please set path by defining $configured_tslib_path
in JavaProxy.php.

Is there something  I have to configure/set up in any case?

Thanks,
Michael

Re: [Php-java-bridge-users] Using PHP/Java Bridge from a separate server

[<php...@li...>]

Hi Ruggero,

What we are doing is running apache with php-fpm on one server and tomcat 6
with PHP/Java bridge on another server. It is working great and without any
issues.

The only thing you have to do is to define the constant JAVA_HOSTS on the
PHP script side and point it to your java server:

define('JAVA_HOSTS', 'http://someserver:8080');

After defining the constant include the Java.inc script and it should work
as expected. (Dont forget to open the needed ports on the java server
firewall - be sure that the java bridge is not exposed to the internet but
only to the php server. Check the security considerations on pjb readme:
http://php-java-bridge.cvs.sourceforge.net/viewvc/php-java-bridge/php-java-bridge/README?view=markup
)

Regards,

Diego

Hi, I have successfully installed PHP/Java Bridge on a Ubuntu 12.04 64 bit
> server with Tomcat and php-cgi; all examples are running OK.
> I would like though now to run PHP code on a separate Ubuntu 12.04 64 bit
> LAMP server, accessing Java classes on the Tomcat server.
> Can anyone help, thank you very much:
> - Is this possible?
> - Do I have to modify the Java.inc include file (and/or the JavaProxy.php
> file) ?
> - Does the Java.inc (and/or the JavaProxy.php file) file have to be on the
> LAMP or on the Tomcat server?
> - Do I have to open any port on the Tomcat server?
> - Do I still have to run PHP as a CGI service?
> Ruggero Domenichini (rujero)



-- 
----------------------------------------
Diego Sainz
Solutions Development
Sperantus
USA: 619-994-3431 / MEX: 646-1246609
http://www.sperantus.com
twitter.com/sperantus
facebook.com/sperantus

[Php-java-bridge-users] Connecting from apache/php-fpm to tomcat's PJB with PHP-CGI disabled

[<php...@li...>]

Hi all,

First of all congrats for PJB - its great software and works great - we
have been using it for a couple years now without any issues.

One thing we haven't been able to fix, thought, is to avoid PJB to start up
php-cgi instances. We are accessing PJB (that is running inside tomcat 6)
from apache and if we disable in web.xml the PHPCGIServlet then it throws
an error saying that it cannot connect to the bridge.

Is there a way to make our PHP apps (running on apache/PHP-FPM) to connect
directly to the java bridge without running any CGI via the tomcat
container?

Thanks in advance,

Diego

[Php-java-bridge-users] Queuing of same requests

[<php...@li...>]

Moin,
I do in a PHP a

$hashtable = array();
$check = new Java('package.Clazz', $hashtable);
$response = java_values($check->check());

For performance reasons, we decided for hash tables an not to use getter
and setter.

It seem to me that same request are queued:

I put a breakpoint in the  Clazz and stop the first request.
If I run a second one in PHP it arrives only when I release the first.

Is it possible to deactivate this behavior?

kind regards Thomas

Re: [Php-java-bridge-users] unflushable class -details

[<php...@li...>]

AC,

your java server (tomcat, etc.) is a permanent process, where as your php
scripts
are evaluated on every request. If you want to see changes to your java
code, you'll have
to restart (redeploy) the service that holds your java classes (tomcat,
pjb-standalone) because
these processes hold the bytecode contained in your .class files in memory
and thus won't notice/care
that the file went away.



On Wed, Jul 18, 2012 at 10:11 AM, <
php...@li...> wrote:

> [PHP code]
> $java = new java_class("my.project.Experiment");
> $myResult = $java->run();
> echo $myResult;
>
> [JAVA code]
> package my.project;
>
> public class Experiment {
>   public static String run(String x){
>     return "results: " +x;
>   }
> }
>
> Until here everything works fine.
>
> Then I create another class, Experiment2, exactly as the first one but the
> method is now called run2.
>
> I delete the Experiment class (NB: if I run "find -name Experiment.class"
> nothing is found).
>
> I then change the PHP code to use Experiment2, and I get an "error 500".
> This is already a problem since the class is there and is very basic.
> But then, if I change the PHP code and try to use the Experiment class, it
> works again!
>
> That sounds as impossible to me because Experiment2.class is for some
> reason not found, and also because Experiment.class is nowhere to be found
> in the system.
>
> The only solution I could find is that PHP is storing the information on
> the java classes somewhere, but I couldn't find where.
> I also tried to delete Firefox's history, but the results are the same.
>
> Any help would be highly appreciated.
> Thanks in advance,
> AC
>
>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> php-java-bridge-users mailing list
> php...@li...
> https://lists.sourceforge.net/lists/listinfo/php-java-bridge-users
>



-- 
Dominik Dorn
http://dominikdorn.com
http://twitter.com/domdorn

Skripten, Mitschriften, Lernunterlagen, etc. findest Du auf
http://www.studyguru.eu !

[Php-java-bridge-users] unflushable class -details

[<php...@li...>]

[PHP code]
$java = new java_class("my.project.Experiment");
$myResult = $java->run();
echo $myResult;

[JAVA code]
package my.project;

public class Experiment {
  public static String run(String x){
    return "results: " +x;
  }
}

Until here everything works fine.

Then I create another class, Experiment2, exactly as the first one but the method is now called run2.

I delete the Experiment class (NB: if I run "find -name Experiment.class" nothing is found).

I then change the PHP code to use Experiment2, and I get an "error 500".
This is already a problem since the class is there and is very basic.
But then, if I change the PHP code and try to use the Experiment class, it works again!

That sounds as impossible to me because Experiment2.class is for some reason not found, and also because Experiment.class is nowhere to be found in the system.

The only solution I could find is that PHP is storing the information on the java classes somewhere, but I couldn't find where.
I also tried to delete Firefox's history, but the results are the same. 

Any help would be highly appreciated.
Thanks in advance,
AC

[Php-java-bridge-users] unflushable class

[<php...@li...>]

Hi,
I'm using this in my PHP file:
$javaClass = new java_class("my.project.MyClass");

Then I delete the MyClass.class file, and the program still runs. How is this possible? Are class files stored somewhere?

Thanks
AC