Restrict Access to Apache Tomcat

Question

Anyone know how to restrict access to Apache Tomcat 6.0 except the followings :

1) allow access from web server (apache httpd) thru AJP ports

<Connector port="1010" protocol="HTTP/1.1" 
           connectionTimeout="20000" 
           redirectPort="1443" maxSavePostSize="-1"/>

2) allow access from localhost thru normal http connector port

<Connector port="1010" protocol="HTTP/1.1" 
           connectionTimeout="20000" 
           redirectPort="1443" maxSavePostSize="-1"/>

3) allow user to connect to web application via web server (apache httpd)

I have tried to restrict access by changing the web context.xml (10.160.2.149 refers to the ip of web server - apache httpd) :

<?xml version='1.0' encoding='utf-8'?>
<Context debug="4"
       displayName="MYAPPS"
       docBase="C:\Frontend"
       path="/abc/devp/fe"
       privileged="true"
       reloadable="true">
<Valve className="org.apache.catalina.valves.RemoteAddrValve"
       allow="127.0.0.1,10.160.2.149"/>
<Manager className="org.apache.catalina.session.PersistentManager"
       entropy="org.apache.catalina.session.PersistentManager@1ac5f13"
       maxActive="1"
       maxInactiveInterval="1800"
       saveOnRestart="false"
       sessionCounter="1">
  <Store className="org.apache.catalina.session.FileStore"/>
</Manager>
</Context>

Tetiana Tetiana · Accepted Answer · 2018-04-27T20:31:07

Here you can find instructions how to restrict access to Tomcat for specified IP addresses or how to request user authentication - Secure Tomcat Hosting: Restrict Access to Your Web Application

Restrict Access to Apache Tomcat

1 Answers