CODEWITHSUNDEEP
javatomcat
Adamski
Adamski

Reputation: 54697

How to disable Tomcat remote deployment?

For security reasons, I would like to disable the remote deployment of web applications via Tomcat's manager page, which allows one to upload and deploy a war file. Is this possible?

Are there any other recommendations for hardening Tomcat against possible attacks?

Thanks in advance.

Upvotes: 0

Views: 2043

Answers (2)

Riddhish.Chaudhari
Riddhish.Chaudhari

Reputation: 853

web application could be restricted by the remote IP address or host by adding a RemoteAddrValve or RemoteHostValve in context.xml

<Context privileged="true">
         <Valve className="org.apache.catalina.valves.RemoteAddrValve"
                allow="127\.0\.0\.1"/>
</Context>

http://blog.techstacks.com/2009/05/tomcat-management-setting-up-tomcat.html

Upvotes: 0

Tarlog
Tarlog

Reputation: 10154

Remove the manager (and also the other preinstalled folders) from the tomcat/webapps folder.

Upvotes: 1

Related Questions