Tomcat 8.5 - 403 Access Denied - java

I've created a virtual machine with Ubuntu 16.04 LTS and, following this guide, I've installed Tomcat 8.5 and configured as follows:
/opt/tomcat/webapps/host-manager/META-INF/context.xml:
<Context antiResourceLocking="false" privileged="true">
<Valve className="org.apache.catalina.valves.RemoteAddrValve"
allow="192\.168\.1\.124|127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" />
</Context>
<!-- my local ip is 192.168.1.124 so I've added it -->
/opt/tomcat/conf/tomcat-users.xml
<role rolename="manager-gui" />
<role rolename="admin-gui" />
<user username="myuser" password="MyPass123#" roles="manager-gui,admin-gui" />
No other configuration files has been modified.
The problem comes out when I try to access to the manager interface from my browser, it doesn't ask me any kind of credentials and throws me a 403 (Access Denied) error.
How can I fix this problem?

This is worked for me. Please check
Find the CATALINA_HOME/webapps/manager/META-INF/context.xml file and add the comment markers around the Valve.
<Context antiResourceLocking="false" privileged="true" >
<!--
<Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" />
-->
</Context>
Tomcat8 Documentation.

Related

How I can connect Apache server remotely (http://149.4.223.238:8080) through my local machine

I am using Eclipse with Tomcat 8.0 and successfully run and deploy web application into Apache server.
Now my question is how I can access online apache host address app manager in order to deploy my application on this host Remove Server Address
tomcat_users.xml
<tomcat-users>
<role rolename="admin-gui"/>
<role rolename="admin-script"/>
<role rolename="manager-gui"/>
<role rolename="manager-script"/>
<role rolename="manager-jmx"/>
<role rolename="manager-status"/>
<user username="tom" password="tom123" roles="admin-gui"/>
<user username="malik" password="malik123" roles="manager-gui,manager-script,manager-jmx,manager-status"/>
</<tomcat-users>
I added this to server.xml
<Connector connectionTimeout="20000" port="8080" protocol="HTTP/1.1" address="149.4.223.238" redirectPort="8443"/>
Context.xml
<Context antiResourceLocking="false" privileged="true" >
<!--
Remove the comment markers from around the Valve below to limit access to
the manager application to clients connecting from localhost
-->
<Valve className="org.apache.catalina.valves.RemoteAddrValve"
allow="149\.4\.223\.238|127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" />
</Context>
I am searching from last 5-7 hours but still not understand.
http://149.4.223.238:8080/manager/html
It looks like you might not have configured it yet. that link also tell you how to set it up. Also if you remote connect with that machine and access that site through localhost:8080/manager/html that should work too.
more details at
https://tomcat.apache.org/tomcat-7.0-doc/manager-howto.html
Your valve configuration is restricting access to IPs in the server itself, the public one and the loopback addresses
<Valve className="org.apache.catalina.valves.RemoteAddrValve"
allow="149\.4\.223\.238|127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" />
So, if you want to allow access from your public IP (be careful with that, it's a security hole) you should include it on the regexp.
As an option, you can access it through an ssh tunnel (can be done with putty too)
ssh -L 8080:localhost:8080 some_user#149.4.223.238
Now it should be accessible from localhost:8080.

Tomcat 8 - Can't access manager app

When I try to access the manager app on my Tomcat server I run into HTTP 404 status:
The requested resource is not available.
To gain access to the manager app I did the following:
Edited the [TOMCAT_HOME]/conf/tomcat-users.xml and created a new user:
<tomcat-users xmlns="http://tomcat.apache.org/xml"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://tomcat.apache.org/xml tomcat-users.xsd" version="1.0">
<role rolename="admin-gui"/>
<role rolename="manager-gui"/>
<user username="admin" password="password" roles="manager-gui,admin-gui"/>
</tomcat-users>
Edited the [TOMCAT_HOME]/webapps/manager/META-INF/context.xml and allowed access from anywhere:
<Context antiResourceLocking="false" privileged="true" >
<!--<Valve className="org.apache.catalina.valves.RemoteAddrValve"
allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" />-->
</Context>
Then I restarted my Tomcat server. I can enter the http://server_domain_or_IP:8080 page but when I click on the link to the manager webapp, I'm faced with the HTTP 404 status.

Unable to deploy war file using Tomcat Manager

I am unable to deploy war file using Tomcat Manager
My \Tomcat\conf\tomcat-users.xml looks like below:
<!--
<role rolename="manager-gui"/>
<user name="tomcat" password="admin" roles="admin-gui,standard,manager-gui"/>
-->
Also, edited \Servers\Tomcat v7.0 Server at localhost-config\tomcat-users.xml to
<!--
<role rolename="manager-gui"/>
<user name="tomcat" password="admin" roles="admin-gui,standard,manager-gui"/>
-->
Still it is showing below error on launching server as http://localhost:8080/manager/html and providing appropriate credentials
401 Unauthorized
You are not authorized to view this page. If you have not changed any configuration files, please examine the file conf/tomcat-users.xml in your installation. That file must contain the credentials to let you use this webapp.
For example, to add the manager-gui role to a user named tomcat with a password of s3cret, add the following to the config file listed above.
I have also tried adding manager.xml to \Tomcat\conf but nothing worked
<Context privileged="true" antiResourceLocking="false"
docBase="${catalina.home}/webapps/manager">
<Valve className="org.apache.catalina.valves.RemoteAddrValve"
allow="127\.0\.0\.1" />
</Context>
Note: I am restarting the server and http://localhost:8080/ is not working
The <role> and <user> tags are just plain text in an XML comment, surrounded by <!-- and -->. Remove the beginning and end of comment.
<!-- <<< BEGINNING OF COMMENT. Remove this line
<role rolename="manager-gui"/>
<user name="tomcat" password="admin" roles="admin-gui,standard,manager-gui"/>
--> <<< END OF COMMENT. Remove this line
You need un-comment user entry in tomcat-users.xml.
You need add users to /tomcat-users.xml otherwise you can't deploy war file through manager app.
Example:
<user username="craigmcc" password="secret" roles="standard,manager-script" />
More configuration details are here.

Tomcat: status code 404 on requests of every application

Every application deployed on my Tomcat returns status code 404 on every request I make. I've tried several projects, helloworlds or skeletons and every project behaves the same as others:
Some of the projects I've used:
https://github.com/mwarman/skeleton-ws-spring-boot
https://spring.io/guides/gs/rest-service/ (I can run it with mvn spring-boot:run but it's not working as deployed to Tomcat)
https://github.com/shagstrom/spring-mvc-hibernate-skeleton
I'm using the newest Tomcat8 (8.0.27), Oracle JDK 8. I've also tried Tomcat7 with OpenJDK 7.
Used Tomcats are running on MAC and Debian.
I've build apps via mvn and via Intellij Idea.
Tomcats are clean, no configs are changed (except adding manager-gui user).
Since I've tried many different projects, I don't believe the problem is in the code. Is it in Tomcat's config? How can I get it to work?
EDIT:
server.xml code:
<?xml version='1.0' encoding='utf-8'?>
<Server port="8005" shutdown="SHUTDOWN">
<Listener className="org.apache.catalina.startup.VersionLoggerListener" />
<!--APR library loader. Documentation at /docs/apr.html -->
<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
<!-- Prevent memory leaks due to use of particular java/javax APIs-->
<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
<Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
<!-- Global JNDI resources
Documentation at /docs/jndi-resources-howto.html
-->
<GlobalNamingResources>
<!-- Editable user database that can also be used by
UserDatabaseRealm to authenticate users
-->
<Resource name="UserDatabase" auth="Container"
type="org.apache.catalina.UserDatabase"
description="User database that can be updated and saved"
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
pathname="conf/tomcat-users.xml" />
</GlobalNamingResources>
<Service name="Catalina">
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
<!-- Define an AJP 1.3 Connector on port 8009 -->
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
<Engine name="Catalina" defaultHost="localhost">
<!-- Use the LockOutRealm to prevent attempts to guess user passwords
via a brute-force attack -->
<Realm className="org.apache.catalina.realm.LockOutRealm">
<!-- This Realm uses the UserDatabase configured in the global JNDI
resources under the key "UserDatabase". Any edits
that are performed against this UserDatabase are immediately
available for use by the Realm. -->
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase"/>
</Realm>
<Host name="localhost" appBase="webapps"
unpackWARs="true" autoDeploy="true">
<!-- SingleSignOn valve, share authentication between web applications
Documentation at: /docs/config/valve.html -->
<!--
<Valve className="org.apache.catalina.authenticator.SingleSignOn" />
-->
<!-- Access log processes all example.
Documentation at: /docs/config/valve.html
Note: The pattern used is equivalent to using pattern="common" -->
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
prefix="localhost_access_log" suffix=".txt"
pattern="%h %l %u %t "%r" %s %b" />
</Host>
</Engine>
</Service>
</Server>
If you installed tomcat successfully, you may have seen tomcat main page from browser http://localhost:8080/ URL. (Otherwise, you need to check tomcat installation first.)
I guess you may have built jar by fallowing above sites that you mentioned.
I am wondering whether you applied the jar into your tomcat or not because you mentioned same result from any other projects.
You need to apply jar or war into your tomcat in order to apply java program.
Here are links that I wish they might be helpful to you.
Packaging war : How to make war file in Eclipse
Tomcat - war file deployment : https://www.youtube.com/watch?v=9X9DA8oVodk
If tomcat returns 404 response, you have to check those points:
check if your deploy was correct
check if war bootstrap and its ServletContext initialization has no errors
check if the resource your invoking was successfully exposed.
To test these issues you have to expose:
static resource test
web service resource test
in this way you can exclude the pitfalls you can meet during application deploy

where/how to setup configuration resources for Tomcat .war files

I have a source tree for a .war file that I need to modify so that I can add some application-specific configuration info (in this case a jdbc connection string, but I may have other properties-like resources). What are the best practices for where to put configuration info and how to access this from within the Servlet?
I'm guessing this Tomcat configuration reference has something to do with it, but my eyes glaze over when I try to read it.
For web app configuration you can place the config on the classpath somewhere. Then you can get to it from your application with getResourceAsStream or if you prefer Spring:
<bean class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
<property name="locations">
<list>
<value>classpath:my-config.properties</value>
</list>
</property>
</bean>
There are a number of places you can put the properties on the classpath in Tomcat. in order it looks at:
/WEB-INF/classes of your web application
/WEB-INF/lib/*. jar of your web application
$CATALINA_HOME/common/classes
$CATALINA_HOME/common/endorsed/*.jar
$CATALINA_HOME/common/i18n/*.jar
$CATALINA_HOME/common/lib / *. jar
$CATALINA_BASE/shared/classes
$CATALINA_BASE/shared/lib/*.jar
For example, if you put my-config.properties both in a .jar file and in WEB-INF/classes the one in WEB-INF/classes will be used. You could use this mechanism to default to test config and override prod config on prod servers.
For the specific case of a JDBC connection string, I would recommend using a Tomcat-managed connection pool instead. You can read more about doing this here:
http://tomcat.apache.org/tomcat-5.5-doc/jndi-datasource-examples-howto.html
It's more work, but I think in the long run it will serve you better.
Hmm. It looks like the easiest path to getting what I want on the Java side of the application is to use Servlet.getServletConfig().getInitParameter(parameterName) e.g. getInitParameter("myApp.connectionString");
But I don't know where to set this. The Tomcat docs talk about various permutations of context.xml but I want to make sure this parameter only affects my servlet and not any others. I also don't want to locate it within my .war file so that I can keep this parameter independent of the applications (for instance if I install an upgrade).
Update: I figured it out, key/value parameters accessible by ServletContext.getInitParameter() go here (or can go here) in ${CATALINA_HOME}/conf/server.xml:
<Server port=... >
...
<Service name="Catalina" ...>
<Engine name="Catalina" ...>
...
<Host name="localhost" ...>
<Context path="/myWarFile">
<Parameter name="foo" value="123" />
<Parameter name="bar" value="456" />
...
</Context>
</Host>
</Engine>
</Service>
</Server>
This sets two parameters, "foo" = "123", "bar" = "456" for the servlet myWarFile.war (or more accurately with the URL path /myWarFile) and I can get at them in Java with Servlet.getServletConfig().getInitParameter("foo") or Servlet.getServletConfig().getInitParameter("bar").
I also looked at JIRA's server.xml entry (and what they tell you to set it to for MySQL), they use a Resource rather than a Parameter, not quite sure of the subtleties of this but it seems like it could be more appropriate method.
<Server port=... >
<Service name="Catalina" ...>
<Engine name="Catalina" ...>
<Host name="localhost" ...>
<Context path="/jira" docBase="${catalina.home}/atlassian-jira"
reloadable="false">
<Resource name="jdbc/JiraDS" auth="Container" type="javax.sql.DataSource"
username="jirauser"
password="..."
driverClassName="com.mysql.jdbc.Driver"
url="jdbc:mysql://localhost/jiradb1?autoReconnect=true&useUnicode=true&characterEncoding=UTF8"
maxActive="20"
validationQuery="select 1"
/>
</Context>
</Host>
</Engine>
</Service>
</Server>
you can add the path to your properties files in your CATALINA_HOME/conf/catalina.properties in the "common" classloader common.loader.

Categories

Resources