Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If we take into account only security concerns, how bad of a practice is it to mount tomcat's manager to Apache2.


JkMount /manager/html* ajp13_worker

I'm doing this because my company has a firewall which blocks anything but web and mail.

share|improve this question
up vote 1 down vote accepted

I would put this on the same level as installing mysqladmin or phpmyadmin on a public web server. Ideally you would not put applications that can do administrative actions on a publicly accessible location (even when protected with passwords, you are vulnerable to a brute force attack).

Furthermore, Tomcat's manager has been known to have had security flaws, so I would avoid using it from anywhere but localhost.

If I understand you correctly, you are trying to access Tomcat's manager from your office. In that case my recommendation would be set it up behind SSL, and to require an approved client SSL certificate for access - this should make it secure enough, provided that you trust your office workstation.

share|improve this answer
thanks for your answer. I like idea about securing tomcat's manager with SSL client verification. Unfortunately, I'm not administrator of web server where tomcat is. It is rented web hosting server. Anyway thanks for link and idea about SSL. – Tiho May 21 '12 at 13:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.