Re: Tomcat user roles

[Bill Wang <bw...@gmail.com>]

Thanks to all for the explanation.

I have a new question regarding the admin role.

With default setup, if I login as admin, I can start,stop, undeploy and
deploy the application. Now, because the admin password has been shared by
team, and I can't not share it with team.

So I plan to disable undeploy and deploy function from the web admin URL
for the admin account. If anyone need deploy new version, they have to
login the Unix box to do it manually. With that I can trace and have
records easily.

So I edit the file webapps/manager/WEB-INF/web.xml, and remove all the xml
sessions for remove, install, undeploy, deploy and save. But after I
restart the tomcat server, *I still can deploy and undeploy*.

Something I missed?

part of tomcat-users.xml

  <role rolename="manager"/>
  <role rolename="tomcat"/>
  <role rolename="admin"/>
  <role rolename="role1"/>
  <role rolename="monitoring"/>
  <user username="admin" password="XXX" roles="admin,manager"/>
  <user username="monitoring" password="XXX" roles="monitoring"/>

Below are the lines I remove from the web.xml file.

  <servlet-mapping>
    <servlet-name>Manager</servlet-name>
      <url-pattern>/install</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>Manager</servlet-name>
      <url-pattern>/remove</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>Manager</servlet-name>
      <url-pattern>/deploy</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>Manager</servlet-name>
      <url-pattern>/undeploy</url-pattern>
  </servlet-mapping>

      <url-pattern>/remove</url-pattern>
      <url-pattern>/deploy</url-pattern>
      <url-pattern>/undeploy</url-pattern>
      <url-pattern>/reload</url-pattern>

I don't find the admin part in web.xml.

Regards,
Bill

On Wed, Nov 30, 2011 at 5:25 AM, Mark Thomas <ma...@apache.org> wrote:

> On 29/11/2011 17:05, Christopher Schultz wrote:
> > Mark,
> >
> > On 11/29/11 11:15 AM, markt@apache.org wrote:
> >> Christopher Schultz <ch...@christopherschultz.net> wrote:
> >
> >>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
> >>>
> >>> Bill,
> >>>
> >>> On 11/28/11 7:08 PM, Bill Wang wrote:
> >>>> Here I have the last question, what's the reload option, is
> >>>> it same as stop/start?
> >>>
> >>> According to markt (who is known to be occasionally
> >>> trustworthy):
> >>>
> >>> reload = stop + start
> >
> >> I'm pretty sure I didn't say that.
> >
> > Sorry, you said:
> >
> > On 11/25/11 12:47 PM, Mark Thomas wrote:
> >> There is no such command as restart. You'll need:
> >> <url-pattern>/html/stop</url-pattern>
> >> <url-pattern>/html/start</url-pattern>
> >
> > I drew my own (perhaps incorrect) conclusion from that.
>
> In short:
> reload != restart
>
> Fuller explanation below. There is a subtle but important difference.
>
> Mark
>
> >> Reload keeps the same Context object (and doesn't reread the
> >> Context config) but does re-read web.xml and allows Jars to be
> >> updated.
> >
> >> Stop/start creates a new Context object (as well as re-reading
> >> web.xml) and is therefore is a full restart of the context.
> >> Reload is sort of half a restart. There is no single command
> >> equivalent to stop/start.
> >
> > Gotcha.
> >
> > -chris
> >
> > ---------------------------------------------------------------------
> >
> >
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> > For additional commands, e-mail: users-help@tomcat.apache.org
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>

Re: Tomcat user roles

[Christopher Schultz <ch...@christopherschultz.net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Bill,

On 12/8/11 7:33 PM, Bill Wang wrote:
> Thanks to all for the explanation.
> 
> I have a new question regarding the admin role.
> 
> With default setup, if I login as admin, I can start,stop, undeploy
> and deploy the application. Now, because the admin password has
> been shared by team, and I can't not share it with team.

Why not use a more elaborate user database that lets you manage lots
of users? There's no need to have shared passwords.

> So I plan to disable undeploy and deploy function from the web
> admin URL for the admin account. If anyone need deploy new version,
> they have to login the Unix box to do it manually. With that I can
> trace and have records easily.

Ok.

I would argue that letting people log into a web-based UI to do
restarts, etc. is safer than giving them shell access, but that's your
business.

> So I edit the file webapps/manager/WEB-INF/web.xml, and remove all
> the xml sessions for remove, install, undeploy, deploy and save.
> But after I restart the tomcat server, *I still can deploy and
> undeploy*.

I suspect you only removed the <security-constraint> sections: that
will open those operations to anyone who knows those URLs, which is
obviously not what you want.

If you have changed the admin password so nobody else knows it and you
will require them to login to a shell, then why do you have to modify
the manager configuration at all?

> Below are the lines I remove from the web.xml file.
> 
> <servlet-mapping> <servlet-name>Manager</servlet-name> 
> <url-pattern>/install</url-pattern> </servlet-mapping>

Are you sure you removed those lines? If you *have* removed them, then
you haven't properly re-deployed the webapp.

- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk7mTykACgkQ9CaO5/Lv0PBiZQCfZkqMvu6AJeiXvhK+S4EPMdiI
PAcAnRt68Ybufzp12ZPODvvbnzbJifmu
=i/JX
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org