Default port 8080
Server operation authority
The running permissions of Tomcat in Linux are related to the Tomcat startup account. For example, if you start as the root user, the shell permission obtained is root. When you start with a normal user, the shell permission obtained is the normal user. For security reasons, use a low-privilege account to start Tomcat.
Windows permission control requires account configuration, create a new Tomcat user, and belong to the Guest group, then set the corresponding permissions to the Tomcat directory, set the file upload folder settings to be agnostic, and then set the service account to the service login account (Local Security Policy-"User Privileges-" Log in as a service), then click the service to log in with this account, restart the service, please see the previous article on the configuration of apache
Server background management
There are three buttons on the Tomcat homepage, which indicate entering the server state, managing the applications deployed on the server, and managing the host interface.
By default, no entry is sent. Clicking any of these buttons will prompt for a user name and password input box, but in fact Tomcat does not configure any user name and password by default.
Set the management user name and password in the tomcat-users.xml file in the conf directory (the default is commented out)
Therefore, the administrator may configure the default account password tomcat: tomcat both: tomcat role1: tomcat
You can use the tomcat account to add the following settings, "manager-gui" has access to the first two buttons, "admin-gui" has access to the third button before
Server access control
By default, Tomcat error will reveal the version information of the server, which is also a kind of information leakage, so it should be hidden as much as possible.
Enter tomcat's lib directory to find the catalina.jar file, unzip it and enter org / apache / catalina / util to edit the configuration file ServerInfo.properties, as shown in the figure
Remove version information and save
Then use the command
jar uvf catalina.jar org/apache/catalina/util/ServerInfo.properties
In this way, the version information of Tomcat will not be leaked
Prohibited directory listing
In order to prevent the directory traversal vulnerability of the Web, the directory list should be prohibited from being displayed on the Web. The setting method is to edit the web.xml file in the Tomcat conf folder and find the following content. If the marked position is true, the directory traversal will occur, and the default is false.
