Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If we take into account only security concerns, how bad of a practice is it to mount tomcat's manager to Apache2.

E.g.,:

JkMount /manager/html* ajp13_worker

I'm doing this because my company has a firewall which blocks anything but web and mail.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

I would put this on the same level as installing mysqladmin or phpmyadmin on a public web server. Ideally you would not put applications that can do administrative actions on a publicly accessible location (even when protected with passwords, you are vulnerable to a brute force attack).

Furthermore, Tomcat's manager has been known to have had security flaws, so I would avoid using it from anywhere but localhost.

If I understand you correctly, you are trying to access Tomcat's manager from your office. In that case my recommendation would be set it up behind SSL, and to require an approved client SSL certificate for access - this should make it secure enough, provided that you trust your office workstation.

share|improve this answer
    
thanks for your answer. I like idea about securing tomcat's manager with SSL client verification. Unfortunately, I'm not administrator of web server where tomcat is. It is rented web hosting server. Anyway thanks for link and idea about SSL. –  Tiho May 21 '12 at 13:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.