Tomcat Security

[JosephB]

I see that the Tomcat service is running as the system administrator, which grants the Tomcat service root access. While testing Tomcat I also found that through your applications you can actually write to any folder on the drive. Is this not a major security risk? What steps must I take to secure Tomcat and possibly set the service to use a restricted user account?

 

[JosephB]

I am quite surprised and disappointed by the poor design of the Tomcat integration, although I am still optimistic towards setting-up up a secure and reliable Tomcat environment. For now I modified the Tomcat service to run as a separate user account to deny it access to system files.

If anyone has any comments regarding securing or setting up Tomcat on Plesk for Windows then please let me know.