tomcat安全配置

配置文件

1. 控制tomcat管理页面的访问

设置IP访问权限：修改/webapps/host-manager/META-INF/context.xml和/webapps/manager/META-INF/context.xml的访问权限

<Valve className="org.apache.catalina.valves.RemoteAddrValve"
         allow="允许访问的IP地址" />

增加权限用户：修改/conf/tomcat-users.xml

<role rolename="manager-gui"/>
<user username="sunpy" password="sunpy" roles="manager-gui"/>

role权限说明：
manager-gui ： 允许访问html接口(即URL路径为/manager/html/)
manager-script：允许访问纯文本接口(即URL路径为/manager/text/)
manager-jmx：允许访问JMX代理接口(即URL路径为/manager/jmxproxy/)
manager-status：允许访问Tomcat只读状态页面(即URL路径为/manager/status/)

---

2. server.xml配置文件

<Realm className="org.apache.catalina.realm.LockOutRealm">

说明：默认配置了LockOutRealm，作用就是避免密码的暴力破解。

<Server port="8005" shutdown="SHUTDOWN">

说明：默认配置了SHUTDOWN监听端口为8005，如果禁用该功能就配置port为-1。

<Host name="localhost"  appBase="webapps"
            unpackWARs="true" autoDeploy="true">

说明：autoDeploy是自动部署，就是将在webapps目录下部署war包会自动解析部署到tomcat，如果禁用自动部署，那么就改为false。

---

传输安全SSL

SSL协议特点：通过SSL协议传输的数据是加密的、通过双方身份鉴别、传输数据的完整性检查。
①生成tomcat证书
在JAVA_HOME/bin下找到工具keytool

./keytool -genkey -alias tomcat -keyalg RSA -keystore /home/tomcat/apache-tomcat-8.5.35/conf/sunpykey.keystore

② 输入指定信息

Enter keystore password:  
Re-enter new password: 
What is your first and last name?
  [Unknown]:  tomcat
What is the name of your organizational unit?
  [Unknown]:  apache
What is the name of your organization?
  [Unknown]:  apche
What is the name of your City or Locality?
  [Unknown]:  hangzhou
What is the name of your State or Province?
  [Unknown]:  zhejiang
What is the two-letter country code for this unit?
  [Unknown]:  cn
Is CN=tomcat, OU=apache, O=apche, L=hangzhou, ST=zhejiang, C=cn correct?
  [no]:  y

③ 配置server.xml文件

    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true">
        <SSLHostConfig>
            <Certificate certificateKeystoreFile="conf/sunpykey.keystore"
                         certificateKeystorePassword="tomcat"
                         type="RSA" />
        </SSLHostConfig>
    </Connector>

④ 导出证书

keytool -keystore /home/tomcat/apache-tomcat-8.5.35/conf/sunpykey.keystore -export -alias tomcat -file /home/tomcat.cer

⑤ chrome导入证书

google导入证书.png