If we take into account only security concerns, how bad of a practice is it to mount tomcat's manager to Apache2.


JkMount /manager/html* ajp13_worker

I'm doing this because my company has a firewall which blocks anything but web and mail.

1 Answer 1


I would put this on the same level as installing mysqladmin or phpmyadmin on a public web server. Ideally you would not put applications that can do administrative actions on a publicly accessible location (even when protected with passwords, you are vulnerable to a brute force attack).

Furthermore, Tomcat's manager has been known to have had security flaws, so I would avoid using it from anywhere but localhost.

If I understand you correctly, you are trying to access Tomcat's manager from your office. In that case my recommendation would be set it up behind SSL, and to require an approved client SSL certificate for access - this should make it secure enough, provided that you trust your office workstation.

  • thanks for your answer. I like idea about securing tomcat's manager with SSL client verification. Unfortunately, I'm not administrator of web server where tomcat is. It is rented web hosting server. Anyway thanks for link and idea about SSL.
    – Tiho
    Commented May 21, 2012 at 13:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .