Tomcat实战案例：启用Tomcat 状态页和管理页面
Posted njsummer
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了Tomcat实战案例：启用Tomcat 状态页和管理页面相关的知识，希望对你有一定的参考价值。
Tomcat的默认首页上 Server status、Manager APP、host-manager 页面的管理。
一、Tomcat启用 Server status、Manager APP页面
1. 问题的引出
在我们安装好Tomcat后，登录到页面右上角（如下图）的状态页面是不能直接登录的，需要对Tomcat的权限进行修改，进而才可登录并进行信息查看、管理和代码等部署。下面将介绍如何启用Tomcat的状态页和管理页面。
默认点击后会出现下面的错误页面
2. 修改配置启用管理页
基本过程：默认的管理页面是被禁用，启用需要修改两个配置文件：一是conf/conf/tomcat-users.xml 添加角色用户；二是要修改webapps/manager/META-INF/context.xml 添加可以访问的地址段。
#### 3.4.4.7 基于WEB的管理Server status和Manager APP可实现应用部署，tomcat 提供了基于WEB的管理页面,默认由 tomcat-admin-webapps.noarch包提供相关文件。实现WEB的管理Server status和Manager APP。 打开浏览器可以访问tomcat管理的默认管理页面，点击下图两个按钮都会出现下面提示403的错误提示。修改；两个文件。
[root@CentOS84-IP68 ]#cd /usr/local/tomcat/
[root@CentOS84-IP68 ]#ls conf/
Catalina catalina.properties jaspic-providers.xml logging.properties tomcat.conf tomcat-users.xsd
catalina.policy context.xml jaspic-providers.xsd server.xml tomcat-users.xml web.xml
# 查看配置信息 conf/server.xml
[root@CentOS84-IP68 ]#cat conf/server.xml
.......................... # 默认省略部分文件内容
<!-- Global JNDI resources
Documentation at /docs/jndi-resources-howto.html
-->
<GlobalNamingResources>
<!-- Editable user database that can also be used by
UserDatabaseRealm to authenticate users
-->
<Resource name="UserDatabase" auth="Container"
type="org.apache.catalina.UserDatabase"
description="User database that can be updated and saved"
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
pathname="conf/tomcat-users.xml" /> ### 看到此处控制用户名和账号的文件 conf/tomcat-users.xml
</GlobalNamingResources>
<!-- A "Service" is a collection of one or more "Connectors" that share
a single "Container" Note: A "Service" is not itself a "Container",
so you may not define subcomponents such as "Valves" at this level.
Documentation at /docs/config/service.html
-->
<Service name="Catalina">
..................................... # 默认省略部分文件内容
##########################################################################################
## 修改控制用户账号控制文件 conf/tomcat-users.xml
[root@CentOS84-IP68 ]#vim conf/tomcat-users.xml
..........................
The users below are wrapped in a comment and are therefore ignored. If you
wish to configure one or more of these users for use with the manager web
application, do not forget to remove the <!.. ..> that surrounds them. You
will also need to set the passwords to something appropriate.
-->
<!--
<user username="admin" password="<must-be-changed>" roles="manager-gui"/>
<user username="robot" password="<must-be-changed>" roles="manager-script"/>
-->
<!--
The sample user and role entries below are intended for use with the
examples web application. They are wrapped in a comment and thus are ignored
when reading this file. If you wish to configure these users for use with the
examples web application, do not forget to remove the <!.. ..> that surrounds
them. You will also need to set the passwords to something appropriate.
-->
<!--
<role rolename="tomcat"/>
<role rolename="role1"/>
<user username="tomcat" password="<must-be-changed>" roles="tomcat"/>
<user username="both" password="<must-be-changed>" roles="tomcat,role1"/>
<user username="role1" password="<must-be-changed>" roles="role1"/>
-->
# 下面两行是新加的用户和密码，角色定义
<role rolename="manager-gui"/>
<user username="admin" password="shone8888" roles="manager-gui"/>
</tomcat-users>
[root@CentOS84-IP68 ]#systemctl restart tomcat
##########################################################################################
### 修改webapps/manager/META-INF/context.xml 查看正则表达式就知道是本地访问了，由于当前访问地址是192.168.X.x，可以修改正则表达式为 allow="127\\.\\d+\\.\\d+\\.\\d+|::1|0:0:0:0:0:0:0:1|192\\.168\\.\\d+\\.\\d+" 这行命令只要模仿配置文件内的写法即可。
[root@CentOS84-IP68 ]#vim webapps/manager/META-INF/context.xml
......................
<Context antiResourceLocking="false" privileged="true" >
<CookieProcessor className="org.apache.tomcat.util.http.Rfc6265CookieProcessor"
sameSiteCookies="strict" />
<Valve className="org.apache.catalina.valves.RemoteAddrValve"
allow="127\\.\\d+\\.\\d+\\.\\d+|::1|0:0:0:0:0:0:0:1|192\\.168\\.250\\.\\d+" />
<Manager sessionAttributeValueClassNameFilter="java\\.lang\\.(?:Boolean|Integer|Long|Number|String)|org\\.apache\\.ca
talina\\.filters\\.CsrfPreventionFilter\\$LruCache(?:\\$1)?|java\\.util\\.(?:Linked)?HashMap"/>
</Context>
..................
[root@CentOS84-IP68 ]#cat webapps/manager/META-INF/context.xml
<?xml version="1.0" encoding="UTF-8"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<Context antiResourceLocking="false" privileged="true" >
<CookieProcessor className="org.apache.tomcat.util.http.Rfc6265CookieProcessor"
sameSiteCookies="strict" />
<Valve className="org.apache.catalina.valves.RemoteAddrValve"
allow="127\\.\\d+\\.\\d+\\.\\d+|::1|0:0:0:0:0:0:0:1|192\\.168\\.250\\.\\d+" />
<Manager sessionAttributeValueClassNameFilter="java\\.lang\\.(?:Boolean|Integer|Long|Number|String)|org\\.apache\\.catalina\\.filters\\.CsrfPreventionFilter\\$LruCache(?:\\$1)?|java\\.util\\.(?:Linked)?HashMap"/>
</Context>
# 上面修改完成后重新启动tomcat 的服务
[root@CentOS84-IP68 ]#systemctl restart tomcat
3. Tomcat 8005端口安全性处置
TCP 8005是Tomcat的管理端口，默认监听在127.0.0.1上。无需验证就可发送SHUTDOWN （必须大写）这个字符串，tomcat接收到后就会关闭此Server。
此管理功能建议禁用，禁用方法：（1）可将SHUTDOWN改为一串猜不出的字符串实现。（2）或者port修改成 0, 会使用随机端口，如:39913。（3）port设为-1等无效端口,将关闭此功能。
[root@CentOS84-IP68 ]#cat /usr/local/tomcat/conf/server.xml | grep 8005
<Server port="8005" shutdown="SHUTDOWN">
[root@CentOS84-IP68 ]#
此行不能被注释的，否则无法启动tomcat服务
# 通过查看监听端口看到 tomcat 默认还开启了 8005 端口的监听
[root@CentOS84-IP68 ]#ss -tln
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 100 *:8080 *:*
LISTEN 0 1 [::ffff:127.0.0.1]:8005 *:*
[root@CentOS84-IP68 ]#
[root@CentOS84-IP68 ]#ss -tlnp
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 100 *:8080 *:* users:(("java",pid=7595,fd=42))
LISTEN 0 1 [::ffff:127.0.0.1]:8005 *:* users:(("java",pid=7595,fd=53))
[root@CentOS84-IP68 ]#
4. 测试登录状态管理页
简要说明：经过上面的修改后，输入上面定义的用户名和密码后就可以登录到Tomcat的状态管理Server status和应用管理Manager APP两个页面了。下面是登录后的界面，可以进行代码部署等。
需要特别强调的是，从下面的页面看到，管理页面权限很大，可以删除和停止APP，实际生产种建议删除掉这个管理页面或者对权限做严格的管控。
二、Tomcat 启用 host-manager 管理页
概要说明：和状态页面一样，tomcat默认的 host-manager 页面也不能直接打开，需要修改配置文集和授权才能正常登录。
要正常打开 host-manager 页面，必须分两个步骤：第一步是修改 /usr/local/tomcat/conf/tomcat-users.xml 添加角色账户和密码；第二步是修改/usr/local/tomcat/webapps/host-manager/META-INF/context.xml 下的IP地址授权范围。
1. 修改 conf/server.xml 文件
[root@CentOS84-IP68 ]#vim /usr/local/tomcat/conf/tomcat-users.xml
.......................... # 省略部分内容
<!--
<role rolename="tomcat"/>
<role rolename="role1"/>
<user username="tomcat" password="<must-be-changed>" roles="tomcat"/>
<user username="both" password="<must-be-changed>" roles="tomcat,role1"/>
<user username="role1" password="<must-be-changed>" roles="role1"/>
-->
# 下面是需要修改的部分，因为前面添加了 manager-gui 角色，本次再添加 admin-gui 角色，参考上面的例子合并格式修改
<role rolename="manager-gui"/>
<role rolename="admin-gui"/>
<user username="admin" password="shone8888" roles="manager-gui,admin-gui"/>
</tomcat-users>
........................ # 省略部分内容
# 修改后完整的 /usr/local/tomcat/conf/tomcat-users.xml 文件内容
[root@CentOS84-IP68 ]#cat /usr/local/tomcat/conf/tomcat-users.xml
<?xml version="1.0" encoding="UTF-8"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to 实战案例：prometheus监控Tomcat（JMX）Tomcat实战案例：升级CentOS7.9下yum安装的Tomcat运行的java环境（JDK）