You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2014/04/08 18:14:03 UTC
[Bug 56370] New: tomcat-users.xml contains legacy roles
https://issues.apache.org/bugzilla/show_bug.cgi?id=56370
Bug ID: 56370
Summary: tomcat-users.xml contains legacy roles
Product: Tomcat 7
Version: unspecified
Hardware: PC
Status: NEW
Severity: normal
Priority: P2
Component: Catalina
Assignee: dev@tomcat.apache.org
Reporter: Martin.Spamer@gmail.com
The configuration file .\conf\tomcat-users.xml contains the follow comment
which includes a number of legacy usernames and roles.
<!--
<role rolename="tomcat"/>
<role rolename="role1"/>
<user username="tomcat" password="tomcat" roles="tomcat"/>
<user username="both" password="tomcat" roles="tomcat,role1"/>
<user username="role1" password="tomcat" roles="role1"/>
-->
The 401 Unauthorized error page .\webapps\manager\WEB-INF\jsp\401.jsp contains
a number of new roles.
I propose the examples placed in .\conf\tomcat-users.xml should reflect these
new roles, e.g.
<!-- manager-gui - allows access to the HTML GUI and the status pages -->
<!-- manager-script - allows access to the text interface and the status
pages -->
<!-- manager-jmx - allows access to the JMX proxy and the status pages -->
<!-- manager-status - allows access to the status pages only -->
<!--
<role rolename="manager-gui"/>
<role rolename="manager-script"/>
<role rolename="manager-jmx"/>
<role rolename="manager-status"/>
<user username="manager-gui" password="*****" roles="manager-gui"/>
<user username="manager-script" password="*****" roles="manager-script"/>
<user username="manager-jmx" password="*****" roles="manager-jmx"/>
<user username="manager-status" password="*****" roles="manager-status"/>
-->
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 56370] tomcat-users.xml contains legacy roles
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56370
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution|--- |WONTFIX
--- Comment #5 from Mark Thomas <ma...@apache.org> ---
(In reply to Martin Spamer from comment #4)
> This should be re-opened and fixed on the grounds refusal make a very weak
> argument.
>
> 1) The tomcat,both and role1 are NOT used by any of the examples, which only
> ship in some distro. The file in error is supplied with all distributions.
Those roles are used by the examples app that ships with Tomcat. If a
distribution removes the examples it should remove the corresponding users from
tomcat-users.xml.
> 2) The examples already provide access with default password so how is that
> ground to refuse to correct this bug.
The examples are not security sensitive. The Manager app is.
> 3) The suggestion uses a blanked out password.
Which means the end result will be a bunch of Tomcat instances where the
Manager password is "******" or whatever is used for the "blanked out"
password. You could set it to "OnlyAnIdiotWouldNotChangeThis" and it would
still not get changed in a significant proportion of installations.
> 4) Refusal increases the barriers to use and makes additional work setting
> up and configuration.
The refusal is based solely on past experience that shows that, with any form
of commented out password for the Manager app, folks simply uncomment it
without engaging their brains first.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 56370] tomcat-users.xml contains legacy roles
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56370
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution|--- |INVALID
--- Comment #3 from Mark Thomas <ma...@apache.org> ---
The required roles are already documented in multiple places. I see no need to
replcate that information in this file.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 56370] tomcat-users.xml contains legacy roles
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56370
Sebb <se...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|INVALID |---
--- Comment #2 from Sebb <se...@apache.org> ---
How about adding a comment to the file to explain that these entries are
intended for use with the examples web app?
Also, it would help if there was at least a pointer to the documentation for
the new manager roles.
I agree that default entries should not be provided, but it would help if the
role names were at least documented, for example by including the first part of
the OP's suggestion, i.e.
<!-- manager-gui - allows access to the HTML GUI and the status pages -->
<!-- manager-script - allows access to the text interface and the status
pages -->
<!-- manager-jmx - allows access to the JMX proxy and the status pages -->
<!-- manager-status - allows access to the status pages only -->
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 56370] tomcat-users.xml contains legacy roles
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56370
--- Comment #6 from Konstantin Kolinko <kn...@gmail.com> ---
(In reply to Sebb from comment #2)
> How about adding a comment to the file...
There is already a comment there, starting with
"NOTE: The sample user and role entries below " ...
How many people here have noted it?
(In reply to Martin Spamer from comment #4)
> 1) 2) ...
You are wrong. A quote from the examples app:
<!-- Security roles referenced by this web application -->
<security-role>
<role-name>role1</role-name>
</security-role>
<security-role>
<role-name>tomcat</role-name>
</security-role>
(In reply to Mark Thomas from comment #5)
+1
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 56370] tomcat-users.xml contains legacy roles
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56370
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |INVALID
OS| |All
--- Comment #1 from Mark Thomas <ma...@apache.org> ---
The commented out roles in tomcat-users.xml are not legacy. They are there to
support the examples web application.
The roles for the manager application are explicitly not assigned ot any users
in tomcat-users.xml, even in commented out form, to avoid any possibility of a
known user with a default password being used for an administrative interface.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 56370] tomcat-users.xml contains legacy roles
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56370
Martin Spamer <Ma...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|INVALID |---
--- Comment #4 from Martin Spamer <Ma...@gmail.com> ---
This should be re-opened and fixed on the grounds refusal make a very weak
argument.
1) The tomcat,both and role1 are NOT used by any of the examples, which only
ship in some distro. The file in error is supplied with all distributions.
2) The examples already provide access with default password so how is that
ground to refuse to correct this bug.
3) The suggestion uses a blanked out password.
4) Refusal increases the barriers to use and makes additional work setting up
and configuration.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org