From da6249cf8d421b2c80e8b05a2e40e39333b9073c Mon Sep 17 00:00:00 2001
From: markt <markt@13f79535-47bb-0310-9956-ffa450edef68>
Date: Thu, 1 Jul 2010 09:57:07 +0000
Subject: [PATCH] Improve default security settings. Enable the LockOutRealm by
 default.

git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@959580 13f79535-47bb-0310-9956-ffa450edef68
---
 conf/server.xml            | 16 ++++++++++------
 webapps/docs/changelog.xml |  4 ++++
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/conf/server.xml b/conf/server.xml
index 338f430d3..86ad0be5e 100644
--- a/conf/server.xml
+++ b/conf/server.xml
@@ -106,12 +106,16 @@
       <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
       -->        
 
-      <!-- This Realm uses the UserDatabase configured in the global JNDI
-           resources under the key "UserDatabase".  Any edits
-           that are performed against this UserDatabase are immediately
-           available for use by the Realm.  -->
-      <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
-             resourceName="UserDatabase"/>
+      <!-- Use the LockOutRealm to prevent attempts to guess user passwords
+           via a brute-force attack -->
+      <Realm className="org.apache.catalina.realm.LockOutRealm">
+        <!-- This Realm uses the UserDatabase configured in the global JNDI
+             resources under the key "UserDatabase".  Any edits
+             that are performed against this UserDatabase are immediately
+             available for use by the Realm.  -->
+        <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
+               resourceName="UserDatabase"/>
+      </Realm>
 
       <!-- Define the default virtual host
            Note: XML Schema validation will not work with Xerces 2.2.
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index af472be13..da0bb0a95 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -75,6 +75,10 @@
         Add support for <code>*.jar</code> pattern in VirtualWebappLoader.
         (kkolinko)
       </add>
+      <add>
+        Use a LockOutRealm in the default configuration to prevent attempts to
+        guess user passwords by brute-force. (markt)
+      </add>
     </changelog>
   </subsection>
   <subsection name="Coyote">
-- 
2.11.0