CODEWITHSUNDEEP
tomcattomcat8
Ecliptica
Ecliptica

Reputation: 840

Can't access Tomcat 8 Manager App

I've just set up Tomcat 8 on an Ubuntu 14.04 VM and I'm not able to access the Manager App at http://[hostname]:8080/manager/html from my browser. I get a "403 Access Denied" error as soon as I click on it. I am running Tomcat as a service defined in a config file in /etc/init.d/tomcat8-dev. The error message indicates that Tomcat is set up to be accessible only from localhost initially, but as it is a hosted VM I'm not able to run a browser on it.

I have set up a user in the tomcat-users.xml file as several people have recommended. However, I am not prompted to provide the credentials for that user, and I can't find any kind of login button on the default page. That file currently looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<tomcat-users xmlns="http://tomcat.apache.org/xml"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://tomcat.apache.org/xml tomcat-users.xsd"
    version="1.0">

    <role rolename="manager-script"/>
    <role rolename="manager-jmx"/>
    <role rolename="manager-gui"/>
    <role rolename="manager-status"/>

    <user username="(redacted)" password="(redacted)" 
        roles="manager-gui,manager-jmx,manager-status,manager-script"/>
</tomcat-users>

After reading the Tomcat documentation page here, I have also tried adding <Valve /> tags into context.xml that look something like this:

<Context privileged="true" antiResourceLocking="false"
    docBase="${catalina.home}/webapps/manager">

    <Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="127\.0\.0\.1" />
    <!--Another valve for my local machine's IP-->

</Context>

However, as soon as I set privileged="true", I get a blank white page when I connect to the server with my browser regardless of the valves I provide afterwards.

I restart my service with sudo service tomcat8-dev restart whenever I make changes.

Other things I have tried based on posts I read here and on other sites:

Nothing I've tried works. Please let me know if you would like more details about my situation. Any suggestions?

Edit: The problem was that I was editing the wrong context.xml file. The correct file is in tomcat/webapps/manager/META-INF. I had incorrectly been making changes to tomcat/conf/context.xml.

Upvotes: 24

Views: 99645

Answers (7)

Zhu Fei
Zhu Fei

Reputation: 21

For me addition to put admin user with manager roles in tomcat-users.xml, I MUST also modify 2 /META-INF/context.xml files of manager and host-manager apps under /webapps, with the following: 127 -> \d+ Thus will make any out-side pcs' browser access to its manager-sitechange 127 localhost IP to any vistors' IP

Upvotes: 1

Rudolf Held
Rudolf Held

Reputation: 533

AFAIK Tomcat blocks access to the Manager App (manager/html) for all hosts but localhost in its default configuration.

To be able to access the manager GUI with http://[hostname]:8080/manager/html, configure this in the configuration files server.xml and the context.xml of the manager application:

Step 1: In [tomcat-install-dir]/conf/server.xml edit the Connector element and add your IP as well as useIPVHosts="true", i.e.:

<Connector port="9009" protocol="AJP/1.3" redirectPort="9443" 
           address="192.168.0.9" useIPVHosts="true" />

address="0.0.0.0" is probably not what you want to insert here, as it exposes the manager GUI to all machines on the network.

Step 2: In [tomcat-install-dir]/webapps/manager/META-INF/context.xml, edit the Valve element and add your IP:

<Context antiResourceLocking="false" privileged="true">

    <Valve className="org.apache.catalina.valves.RemoteAddrValve"
           allow="192\.168\.0\.9|127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" />
</Context>

From Tomcat 8 context documentation

privileged : Set to true to allow this context to use container servlets, like the manager servlet.

antiResourceLocking : If true, Tomcat will prevent any file locking. This will significantly impact startup time of applications, but allows full webapp hot deploy and undeploy on platforms or configurations where file locking can occur

Note, that I don't add another Valve element as you mentioned in the list of things you tried but instead I edit the existing one and just add my IP (192.168.0.9).

Step 3: Restart Tomcat and you should be able to access the manager GUI with localhost / 127.0.0.1 as well as with your hostname / IP.

NOTE

Regarding your tomcat-users.xml, the Tomcat Manager HOW-TO states:

It is recommended to never grant the manager-script or manager-jmx roles to users that have the manager-gui role.

So you might want to introduce two users in your tomcat-users.xml, i.e.:

  <role rolename="manager-script"/>
  <role rolename="manager-jmx"/>
  <role rolename="manager-gui"/>
  <role rolename="manager-status"/>
  <user username="alice" password="whatever" roles="manager-script,manager-jmx"/>
  <user username="bob" password="whatever" roles="manager-gui,manager-status"/>

Upvotes: 26

Bheem Singh
Bheem Singh

Reputation: 707

Update the 'apache-tomcat-8.5.5\webapps\manager\META-INF\context.xlm file. uncomment the Value tag. and restart server

context.xml file

Before : 

<Context antiResourceLocking="false" privileged="true">
<Valve className="org.apache.catalina.valves.RemoteAddrValve"
     allow="192\.168\.0\.9|127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" />
</Context>

After change :

<Context antiResourceLocking="false" privileged="true" >
</Context>

for auto deployment: go to 'apache-tomcat-8.5.5\conf\context.xml' and add antiResourceLocking="true" in 'Context' tag

Upvotes: 0

Thirumaran
Thirumaran

Reputation: 499

You can simply do like if you want to access manager app on all machines. Go to {Tomcat_install_DIR}/webapps/manager/META-INF/ and edit context.xml put 

<Context antiResourceLocking="false" privileged="true" >
 <!--
 <Valve className="org.apache.catalina.valves.RemoteAddrValve" 
  allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" />
  -->
</Context>

Upvotes: 5

Palash
Palash

Reputation: 159

I also fetched same issue and what i did first added role user and passowrd in config/tomcat-users.xml then allowed my public ip in webapps/manager/META-INF/context.xml there initially local ip 127 added for use manager from same machine. there add your ip

Upvotes: 0

Akash Rai
Akash Rai

Reputation: 11

I think this might help for all of you because its work for me.

Here I'm using Apache tomcat 8:

root@akash-LIFEBOOK-A555:/opt/apache-tomcat-8.5.20/bin# ./version.sh 
Using CATALINA_BASE:   /opt/apache-tomcat-8.5.20
Using CATALINA_HOME:   /opt/apache-tomcat-8.5.20
Using CATALINA_TMPDIR: /opt/apache-tomcat-8.5.20/temp
Using JRE_HOME:        /DATA/jre1.8.0_131/
Using CLASSPATH:       /opt/apache-tomcat-8.5.20/bin/bootstrap.jar:/opt/apache-tomcat-8.5.20/bin/tomcat-juli.jar
Server version: Apache Tomcat/8.5.20
Server built:   Aug 2 2017 21:35:49 UTC
Server number:  8.5.20.0
OS Name:        Linux
OS Version:     4.4.0-98-generic
Architecture:   amd64
JVM Version:    1.8.0_131-b11
JVM Vendor:     Oracle Corporation

Edit tomcat-user.xml and added the roles and users

<role rolename="manager-gui"/>
<role rolename="manager-status"/>
<role rolename="manager-script"/>
<role rolename="manager-jmx"/>
<role rolename="admin-gui"/>
<user username="admin" password="password" roles="manager-gui,manager-status,manager-script,manager-jmx,admin-gui"/>

Upvotes: 1

PetrS
PetrS

Reputation: 11

You should change:

docBase="${catalina.home}/webapps/manager"

to:

docBase="${catalina.base}/webapps/manager"

This is because you don't use Tomcat as distributed from upstream but the one which comes with Ubuntu.

Upvotes: 1

Related Questions