You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by "James H. H. Lampert" <ja...@touchtonecorp.com.INVALID> on 2023/02/22 17:10:03 UTC
Got a customer who's paranoid about Manager
We've got a customer -- the same one that was our first test of a
working RemoteAddrValve -- whose security consultant is complaining that
a potential intruder can confirm the *existence* of the manager context
(because it returns a 403, as opposed to, say, a 404).
Any ideas?
--
JHHL
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Got a customer who's paranoid about Manager
Posted by "James H. H. Lampert" <ja...@touchtonecorp.com.INVALID>.
On 2/23/23 9:17 AM, Mark Thomas wrote:
> You need to remove the error page entry for 404 errors from
> WEB-INF/web.xml rather than / as well as renaming / removing 404.jsp
>
> Delete (or comment out) these lines:
>
> <error-page>
> <error-code>404</error-code>
> <location>/WEB-INF/jsp/404.jsp</location>
> </error-page>
Thanks. I really wish certain other support lists and boards were as
eager to help as you have been.
It looks like seeing the effects of this will have to wait for tonight's
restart. It seems like when you run Tomcat on an IBM Midrange box,
*almost every change* has to wait for a restart.
In other news, it appears that updating the Java on that other
installation that was going into a runaway state and crashing has solved
their problems: heap allocations are topping out, but so far no runaways
or crashes.
--
JHHL
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Got a customer who's paranoid about Manager
Posted by Mark Thomas <ma...@apache.org>.
On 23/02/2023 16:49, James H. H. Lampert wrote:
> On 2/22/23 9:23 AM, Mark Thomas wrote:
>
>> Alternatively, you can use denyStatus="404" on the RemoteAddrValve.
>> That attribute should be available in all versions of all currently
>> supported Tomcat releases (it was added back in 2011). You can set it
>> to any value valid for use with HttpServletResponse.sendError(int).
>
> Now that the customer's Tomcat server has had its nightly restart, I see
> that adding
>
>> denyStatus="404"
>
> to the RemoteAddrValve does indeed give me a 404 page. But it's a 404
> page that still admits to the *existence* of a manager context.
>
> I note that if I give it a manifestly nonexistent webapp context, e.g.,
> "/foobar," I get a default 404 page. But if I simply rename
> /manager/WEB-INF/jsp/404.jsp to 404.jsp.bak, and I (without waiting for
> a Tomcat restart) go to the manager from an unauthorized URL, I get
> *nothing* -- in Firefox, I get a blank page, and in Chrome, I get a
> Chrome-generated message that there is nothing there.
>
> Is there a way, short of manually duplicating the default 404 page, that
> I can have /manager look *exactly* like /foobar to an unauthorized
> requester?
>
> (Or would waiting for the next scheduled Tomcat restart, with the
> manager's 404 page renamed, give me that result?)
You need to remove the error page entry for 404 errors from
WEB-INF/web.xml rather than / as well as renaming / removing 404.jsp
Delete (or comment out) these lines:
<error-page>
<error-code>404</error-code>
<location>/WEB-INF/jsp/404.jsp</location>
</error-page>
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Got a customer who's paranoid about Manager
Posted by "James H. H. Lampert" <ja...@touchtonecorp.com.INVALID>.
On 2/22/23 9:23 AM, Mark Thomas wrote:
> Alternatively, you can use denyStatus="404" on the RemoteAddrValve. That
> attribute should be available in all versions of all currently supported
> Tomcat releases (it was added back in 2011). You can set it to any value
> valid for use with HttpServletResponse.sendError(int).
Now that the customer's Tomcat server has had its nightly restart, I see
that adding
> denyStatus="404"
to the RemoteAddrValve does indeed give me a 404 page. But it's a 404
page that still admits to the *existence* of a manager context.
I note that if I give it a manifestly nonexistent webapp context, e.g.,
"/foobar," I get a default 404 page. But if I simply rename
/manager/WEB-INF/jsp/404.jsp to 404.jsp.bak, and I (without waiting for
a Tomcat restart) go to the manager from an unauthorized URL, I get
*nothing* -- in Firefox, I get a blank page, and in Chrome, I get a
Chrome-generated message that there is nothing there.
Is there a way, short of manually duplicating the default 404 page, that
I can have /manager look *exactly* like /foobar to an unauthorized
requester?
(Or would waiting for the next scheduled Tomcat restart, with the
manager's 404 page renamed, give me that result?)
--
JHHL
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Got a customer who's paranoid about Manager
Posted by Alex O'Ree <al...@apache.org>.
is removing the manager war an option for you? i don't think it's required
for operation. you could also rename it so that it's in a different url
path than the default
On Wed, Feb 22, 2023 at 12:58 PM Mark Thomas <ma...@apache.org> wrote:
> On 22/02/2023 17:49, James H. H. Lampert wrote:
> > On 2/22/23 9:23 AM, Mark Thomas wrote:
> >> Fire them and hire a security consultant with a proper understanding
> >> of risk?
> >
> > Pardon my Yiddish, but "Fun dayn moyl in Gots oyern." (From your mouth
> > to God's ears. Such a colorful language.)
> >
> > But just because you're paranoid doesn't mean they're not out to get you.
> >
> > So just add
> >
> > denyStatus="404"
> > to the RemoteAddrValve?
>
> Exactly.
>
> Mark
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: Got a customer who's paranoid about Manager
Posted by Mark Thomas <ma...@apache.org>.
On 22/02/2023 17:49, James H. H. Lampert wrote:
> On 2/22/23 9:23 AM, Mark Thomas wrote:
>> Fire them and hire a security consultant with a proper understanding
>> of risk?
>
> Pardon my Yiddish, but "Fun dayn moyl in Gots oyern." (From your mouth
> to God's ears. Such a colorful language.)
>
> But just because you're paranoid doesn't mean they're not out to get you.
>
> So just add
>
> denyStatus="404"
> to the RemoteAddrValve?
Exactly.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Got a customer who's paranoid about Manager
Posted by "James H. H. Lampert" <ja...@touchtonecorp.com.INVALID>.
On 2/22/23 9:23 AM, Mark Thomas wrote:
> Fire them and hire a security consultant with a proper understanding of
> risk?
Pardon my Yiddish, but "Fun dayn moyl in Gots oyern." (From your mouth
to God's ears. Such a colorful language.)
But just because you're paranoid doesn't mean they're not out to get you.
So just add
denyStatus="404"
to the RemoteAddrValve?
--
JHHL
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Got a customer who's paranoid about Manager
Posted by Mark Thomas <ma...@apache.org>.
On 22/02/2023 17:10, James H. H. Lampert wrote:
> We've got a customer -- the same one that was our first test of a
> working RemoteAddrValve -- whose security consultant is complaining that
> a potential intruder can confirm the *existence* of the manager context
> (because it returns a 403, as opposed to, say, a 404).
>
> Any ideas?
Fire them and hire a security consultant with a proper understanding of
risk?
Alternatively, you can use denyStatus="404" on the RemoteAddrValve. That
attribute should be available in all versions of all currently supported
Tomcat releases (it was added back in 2011). You can set it to any value
valid for use with HttpServletResponse.sendError(int).
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org