• Halloween is coming! To celebrate the occasion, we dusted off a couple of old skins, and even created a brand new one (Pixel).
    To get into the festive spirit, install the Skins extension.
  • The new Python extension is now available. It allows customers to deploy and manage WSGI-based Python applications on their websites directly from Plesk.
  • The Plesk Mobile apps for iOS and Android and the Plesk Mobile Center extension have been deprecated, and are no longer available for new installations. In Plesk Obsidian 18.0.84, the Plesk Mobile Center extension will be removed from servers during the upgrade, and the Plesk Mobile apps will lose their server management features.
  • The Social Login extension has been deprecated and will be removed in Plesk Obsidian 18.0.84. After that, it will no longer be possible to log in to Plesk with a Google, Facebook, GitHub account, or with a passkey. Plesk usernames and passwords, as well as logging in with a WebPros Account, are not affected.

Tomcat Security

J

JosephB

Guest
I see that the Tomcat service is running as the system administrator, which grants the Tomcat service root access. While testing Tomcat I also found that through your applications you can actually write to any folder on the drive. Is this not a major security risk? What steps must I take to secure Tomcat and possibly set the service to use a restricted user account?
 
I am quite surprised and disappointed by the poor design of the Tomcat integration, although I am still optimistic towards setting-up up a secure and reliable Tomcat environment. For now I modified the Tomcat service to run as a separate user account to deny it access to system files.

If anyone has any comments regarding securing or setting up Tomcat on Plesk for Windows then please let me know.
 
You must log in or register to reply here.

Similar threads

skibbler
"securityRiskFeature" not hiding Security-Risk score
Replies
4
Views
5K
skibbler
skibbler
F
Input Critical security updates need technical details
Replies
17
Views
7K
danim
D
E
Forwarded to devs [Bug] ACME Extension Ignores Updated EAB Credentials – Old Account Remains Cached for Domain
Replies
3
Views
3K
end
E
learning_curve
Resolved SSL It! / Let's Encrypt installs incomplete Generation Y RSA certificate chain (YR1/YR2 → Root YR) without Root YR cross-sign to ISRG Root X1
Replies
6
Views
6K
learning_curve
learning_curve
Hangover2
Critical security issue fixed on 24–25 February 2026 (Plesk Obsidian 18.0.75 Update 1 / 18.0.76 Update 2) — request for vulnerability details
Replies
4
Views
10K
Hangover2
Hangover2
Back
Top