RE: HTTP-server, Websphere, security

[Erik Mitsch <baron@xxxxxxxxxxxxx>]

Hey Marc,

> But on the production machine you can access the pages without entering a
> password. Apearently, the setting on both machines are the same.
> As I understand the documentations, the Websphere also has security
> settings, but we don't use them.

You'll definately want to take a look at those Websphere security settings,
and also the security settings for the WAS Default User on the production
machine.  As I understand it (which could be flawed), both the HTTP Server
and WAS have a default "user" (QHTTPSRV or something?), which allow the user
to view the files defined as accessable to the public.  However, if these
settings are flawed in any way, it could allow a user greater access, which
would explain why one can get in without a password.

That's what it appears at first blush to me, at least.  Hope it helps!

- Erik
http://www.baron-inc.net