TOMCAT默认配置的安全问题

我爱小虾

　　有一个文件tomcat\conf\server.xml，里面默认的内容为
　　<Server port="8005" shutdown="SHUTDOWN"><!-- Comment these entries out to disable JMX MBeans support used for the administration web application --><Listener className="org.apache.catalina.core.AprLifecycleListener" /><Listener className="org.apache.catalina.mbeans.ServerLifecycleListener" /><Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" /><Listener className="org.apache.catalina.storeconfig.StoreConfigLifecycleListener"/><!-- Global JNDI resources --><GlobalNamingResources><!-- Test entry for demonstration purposes --><Environment name="simpleValue" type="java.lang.Integer" value="30"/><!-- Editable user database that can also be used byUserDatabaseRealm to authenticate users --><Resource name="UserDatabase" auth="Container"type="org.apache.catalina.UserDatabase"description="User database that can be updated and saved"factory="org.apache.catalina.users.MemoryUserDatabaseFactory"pathname="conf/tomcat-users.xml" /></GlobalNamingResources><!-- A "Service" is a collection of one or more "Connectors" that sharea single "Container" (and therefore the web applications visiblewithin that Container).  Normally, that Container is an "Engine",but this is not required.Note:  A "Service" is not itself a "Container", so you may notdefine subcomponents such as "Valves" or "Loggers" at this level.--><!-- Define the Tomcat Stand-Alone Service --><Service name="Catalina"><!-- A "Connector" represents an endpoint by which requests are receivedand responses are returned.  Each Connector passes requests on to theassociated "Container" (normally an Engine) for processing.By default, a non-SSL HTTP/1.1 Connector is established on port 8080.You can also enable an SSL HTTP/1.1 Connector on port 8443 byfollowing the instructions below and uncommenting the second Connectorentry.  SSL support requires the following steps (see the SSL ConfigHOWTO in the Tomcat 5 documentation bundle for more detailedinstructions):* If your JDK version 1.3 or prior, download and install JSSE 1.0.2 orlater, and put the JAR files into "$JAVA_HOME/jre/lib/ext".* Execute:%JAVA_HOME%\bin\keytool -genkey -alias tomcat -keyalg RSA (Windows)$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA  (Unix)with a password value of "changeit" for both the certificate andthe keystore itself.By default, DNS lookups are enabled when a web application callsrequest.getRemoteHost().  This can have an adverse impact onperformance, so you can disable it by setting the"enableLookups" attribute to "false".  When DNS lookups are disabled,request.getRemoteHost() will return the String version of theIP address of the remote client.--><!-- Define a non-SSL HTTP/1.1 Connector on port 8080 --><Connectorport="8080"               maxHttpHeaderSize="8192" URIEncoding="utf-8"maxThreads="150" minSpareThreads="25" maxSpareThreads="75"enableLookups="false" redirectPort="8443" acceptCount="100"connectionTimeout="20000" disableUploadTimeout="true" compression="on" compressionMinSize="2048" noCompressionUserAgents="gozilla, traviata" compressableMimeType="text/html,text/xml,application/x-javascript,application/javascript,text/javascript"/><!-- Note : To disable connection timeouts, set connectionTimeout valueto 0 --><!-- Note : To use gzip compression you could set the following properties :compression="on" compressionMinSize="2048" noCompressionUserAgents="gozilla, traviata" compressableMimeType="text/html,text/xml"--><!-- Define a SSL HTTP/1.1 Connector on port 8443 --><!--<Connector port="8443" maxHttpHeaderSize="8192"maxThreads="150" minSpareThreads="25" maxSpareThreads="75"enableLookups="false" disableUploadTimeout="true"acceptCount="100" scheme="https" secure="true"clientAuth="false" sslProtocol="TLS" />--><!-- Define an AJP 1.3 Connector on port 8009 --><Connector port="8009" enableLookups="false" redirectPort="8443" protocol="AJP/1.3" /><!-- Define a Proxied HTTP/1.1 Connector on port 8082 --><!-- See proxy documentation for more information about using this. --><!--<Connector port="8082" maxThreads="150" minSpareThreads="25" maxSpareThreads="75"enableLookups="false" acceptCount="100" connectionTimeout="20000"proxyPort="80" disableUploadTimeout="true" />--><!-- An Engine represents the entry point (within Catalina) that processesevery request.  The Engine implementation for Tomcat stand aloneanalyzes the HTTP headers included with the request, and passes themon to the appropriate Host (virtual host). --><!-- You should set jvmRoute to support load-balancing via AJP ie :<Engine name="Standalone" defaultHost="localhost" jvmRoute="jvm1">         --> <!-- Define the top level container in our container hierarchy --><Engine name="Catalina" defaultHost="localhost"><!-- The request dumper valve dumps useful debugging information aboutthe request headers and cookies that were received, and the responseheaders and cookies that were sent, for all requests received bythis instance of Tomcat.  If you care only about requests to aparticular virtual host, or a particular application, nest thiselement inside the corresponding <Host> or <Context> entry instead.For a similar mechanism that is portable to all Servlet 2.4containers, check out the "RequestDumperFilter" Filter in theexample application (the source for this filter may be found in"$CATALINA_HOME/webapps/examples/WEB-INF/classes/filters").Request dumping is disabled by default.  Uncomment the followingelement to enable it. --><!--<Valve className="org.apache.catalina.valves.RequestDumperValve"/>--><!-- Because this Realm is here, an instance will be shared globally --><!-- This Realm uses the UserDatabase configured in the global JNDIresources under the key "UserDatabase".  Any editsthat are performed against this UserDatabase are immediatelyavailable for use by the Realm.  --><Realm className="org.apache.catalina.realm.UserDatabaseRealm"resourceName="UserDatabase"/><!-- Comment out the old realm but leave here for now in case weneed to go back quickly --><!--<Realm className="org.apache.catalina.realm.MemoryRealm" />--><!-- Replace the above Realm with one of the following to get a Realmstored in a database and accessed via JDBC --><!--<Realm  className="org.apache.catalina.realm.JDBCRealm"driverName="org.gjt.mm.mysql.Driver"connectionURL="jdbc:mysql://localhost/authority"connectionName="test" connectionPassword="test"userTable="users" userNameCol="user_name" userCredCol="user_pass"userRoleTable="user_roles" roleNameCol="role_name" />--><!--<Realm  className="org.apache.catalina.realm.JDBCRealm"driverName="oracle.jdbc.driver.OracleDriver"connectionURL="jdbc:oracle:thin:@ntserver:1521:ORCL"connectionName="scott" connectionPassword="tiger"userTable="users" userNameCol="user_name" userCredCol="user_pass"userRoleTable="user_roles" roleNameCol="role_name" />--><!--<Realm  className="org.apache.catalina.realm.JDBCRealm"driverName="sun.jdbc.odbc.JdbcOdbcDriver"connectionURL="jdbc:odbc:CATALINA"userTable="users" userNameCol="user_name" userCredCol="user_pass"userRoleTable="user_roles" roleNameCol="role_name" />--><!-- Define the default virtual hostNote: XML Schema validation will not work with Xerces 2.2.--><Host name="localhost" appBase="webapps"unpackWARs="true" autoDeploy="true"xmlValidation="false" xmlNamespaceAware="false"><!-- Defines a cluster for this node,By defining this element, means that every manager will be changed.So when running a cluster, only make sure that you have webapps in therethat need to be clustered and remove the other ones.A cluster has the following parameters:className = the fully qualified name of the cluster classname = a descriptive name for your cluster, can be anythingmcastAddr = the multicast address, has to be the same for all the nodesmcastPort = the multicast port, has to be the same for all the nodesmcastBindAddr = bind the multicast socket to a specific addressmcastTTL = the multicast TTL if you want to limit your broadcastmcastSoTimeout = the multicast readtimeout mcastFrequency = the number of milliseconds in between sending a "I'm alive" heartbeatmcastDropTime = the number a milliseconds before a node is considered "dead" if no heartbeat is receivedtcpThreadCount = the number of threads to handle incoming replication requests, optimal would be the same amount of threads as nodes tcpListenAddress = the listen address (bind address) for TCP cluster request on this host, in case of multiple ethernet cards.auto means that address becomesInetAddress.getLocalHost().getHostAddress()tcpListenPort = the tcp listen porttcpSelectorTimeout = the timeout (ms) for the Selector.select() method in case the OShas a wakup bug in java.nio. Set to 0 for no timeoutprintToScreen = true means that managers will also print to std.outexpireSessionsOnShutdown = true means that useDirtyFlag = true means that we only replicate a session after setAttribute,removeAttribute has been called.false means to replicate the session after each request.false means that replication would work for the following piece of code: (only for SimpleTcpReplicationManager)<%HashMap map = (HashMap)session.getAttribute("map");map.put("key","value");%>replicationMode = can be either 'pooled', 'synchronous' or 'asynchronous'.* Pooled means that the replication happens using several sockets in a synchronous way. Ie, the data gets replicated, then the request return. This is the same as the 'synchronous' setting except it uses a pool of sockets, hence it is multithreaded. This is the fastest and safest configuration. To use this, also increase the nr of tcp threads that you have dealing with replication.* Synchronous means that the thread that executes the request, is also thethread the replicates the data to the other nodes, and will not return until allnodes have received the information.* Asynchronous means that there is a specific 'sender' thread for each cluster node,so the request thread will queue the replication request into a "smart" queue,and then return to the client.The "smart" queue is a queue where when a session is added to the queue, and the same sessionalready exists in the queue from a previous request, that session will be replacedin the queue instead of replicating two requests. This almost never happens, unless there is a large network delay.-->             <!--When configuring for clustering, you also add in a valve to catch all the requestscoming in, at the end of the request, the session may or may not be replicated.A session is replicated if and only if all the conditions are met:1. useDirtyFlag is true or setAttribute or removeAttribute has been called AND2. a session exists (has been created)3. the request is not trapped by the "filter" attributeThe filter attribute is to filter out requests that could not modify the session,hence we don't replicate the session after the end of this request.The filter is negative, ie, anything you put in the filter, you mean to filter out,ie, no replication will be done on requests that match one of the filters.The filter attribute is delimited by ;, so you can't escape out ; even if you wanted to.filter=".*\.gif;.*\.js;" means that we will not replicate the session after requests with the URIending with .gif and .js are intercepted.The deployer element can be used to deploy apps cluster wide.Currently the deployment only deploys/undeploys to working members in the clusterso no WARs are copied upons startup of a broken node.The deployer watches a directory (watchDir) for WAR files when watchEnabled="true"When a new war file is added the war gets deployed to the local instance,and then deployed to the other instances in the cluster.When a war file is deleted from the watchDir the war is undeployed locally and cluster wide--><!--<Cluster className="org.apache.catalina.cluster.tcp.SimpleTcpCluster"managerClassName="org.apache.catalina.cluster.session.DeltaManager"expireSessionsOnShutdown="false"useDirtyFlag="true"notifyListenersOnReplication="true"><Membership className="org.apache.catalina.cluster.mcast.McastService"mcastAddr="228.0.0.4"mcastPort="45564"mcastFrequency="500"mcastDropTime="3000"/><Receiver className="org.apache.catalina.cluster.tcp.ReplicationListener"tcpListenAddress="auto"tcpListenPort="4001"tcpSelectorTimeout="100"tcpThreadCount="6"/><SenderclassName="org.apache.catalina.cluster.tcp.ReplicationTransmitter"replicationMode="pooled"ackTimeout="15000"/><Valve className="org.apache.catalina.cluster.tcp.ReplicationValve"filter=".*\.gif;.*\.js;.*\.jpg;.*\.htm;.*\.html;.*\.txt;"/><Deployer className="org.apache.catalina.cluster.deploy.FarmWarDeployer"tempDir="/tmp/war-temp/"deployDir="/tmp/war-deploy/"watchDir="/tmp/war-listen/"watchEnabled="false"/></Cluster>-->        <!-- Normally, users must authenticate themselves to each web appindividually.  Uncomment the following entry if you would likea user to be authenticated the first time they encounter aresource protected by a security constraint, and then have thatuser identity maintained across *all* web applications containedin this virtual host. --><!--<Valve className="org.apache.catalina.authenticator.SingleSignOn" />--><!-- Access log processes all requests for this virtual host.  Bydefault, log files are created in the "logs" directory relative to$CATALINA_HOME.  If you wish, you can specify a differentdirectory with the "directory" attribute.  Specify either a relative(to $CATALINA_HOME) or absolute path to the desired directory.--><!--<Valve className="org.apache.catalina.valves.AccessLogValve"directory="logs"  prefix="localhost_access_log." suffix=".txt"pattern="common" resolveHosts="false"/>--><!-- Access log processes all requests for this virtual host.  Bydefault, log files are created in the "logs" directory relative to$CATALINA_HOME.  If you wish, you can specify a differentdirectory with the "directory" attribute.  Specify either a relative(to $CATALINA_HOME) or absolute path to the desired directory.This access log implementation is optimized for maximum performance,but is hardcoded to support only the "common" and "combined" patterns.--><!--<Valve className="org.apache.catalina.valves.FastCommonAccessLogValve"directory="logs"  prefix="localhost_access_log." suffix=".txt"pattern="common" resolveHosts="false"/>--></Host><Host name="site" appBase="F:\JS_Workspace"unpackWARs="true" autoDeploy="true"xmlValidation="false" xmlNamespaceAware="false"/></Engine></Service></Server>
　　第一行<Server port="8005" shutdown="SHUTDOWN">，可以让我们使用telnet 连上8005端口，输入SHUTDOWN命令tomcat重启
　　可以将shutdown的命令修改成其他不容易猜测的字符串