如何限制對反向代理 tomcat 上下文的上下文的訪問？

我有一個使用 apache 反向代理執行的 tomcat 應用程序。我試圖限制僅從本地主機訪問管理器和主機管理器上下文。

因此，我從兩個上下文中取消了對 context.xml 文件的以下行的註釋：

<!--
Remove the comment markers from around the Valve below to limit access to
the manager application to clients connecting from localhost
-->
<Valve className="org.apache.catalina.valves.RemoteAddrValve"
    allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" />

但是當我嘗試從 localhost 訪問這些上下文時，它總是向我顯示錯誤 403 頁面。

我沒有在允許屬性中得到*d+的東西，所以我也嘗試了allow=“127.0.0.1|::1|0:0:0:0:0:0:0:1”*也沒有運氣。

我的 context.xml 配置有問題嗎？

當它們首先通過 apache 的 mod_proxy ( ProxyPass ajp://localhost:8009 ) 過濾連接時，它的行為是否有所不同？

謝謝

這裡有兩種不同的機制：限制對上下文的訪問（使用 完成RemoteAddrValve）和內置的 RBAC server.xml：

<Resource name="UserDatabase" auth="Container"
         type="org.apache.catalina.UserDatabase"
         description="User database that can be updated and saved"
         factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
         pathname="conf/tomcat-users.xml" />

以下已使用 進行了測試tomcat-8.0.23：

僅通過修改文件以刪除閥門上的註釋來修改庫存配置以限制localhost對manager上下文的訪問：apache-tomcat-8.0.23/webapps/manager/META-INF/context.xml

<Valve className="org.apache.catalina.valves.RemoteAddrValve"
     allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" /> 

如果沒有進一步的修改，訪問上下文的嘗試會失敗並出現 401 HTTP 錯誤：

$ curl -v -L localhost:8080/manager/
*   Trying ::1...
* Connected to localhost (::1) port 8080 (#0)
> GET /manager/ HTTP/1.1
> User-Agent: curl/7.40.0
> Host: localhost:8080
> Accept: */*
>
< HTTP/1.1 302 Found
< Server: Apache-Coyote/1.1
< Set-Cookie: JSESSIONID=F3F2A25463ED1CD49E154FA5428B853A; Path=/manager/; HttpOnly
< Location: http://localhost:8080/manager/html;jsessionid=F3F2A25463ED1CD49E154FA5428B853A?org.apache.catalina.filters.CSRF_NONCE=B5CB272DF379F59A8158583826850550
< Content-Type: text/html;charset=ISO-8859-1
< Content-Length: 0
< Date: Sun, 14 Jun 2015 08:47:27 GMT
<
* Connection #0 to host localhost left intact
* Issue another request to this URL: 'http://localhost:8080/manager/html;jsessionid=F3F2A25463ED1CD49E154FA5428B853A?org.apache.catalina.filters.CSRF_NONCE=B5CB272DF379F59A8158583826850550'
* Found bundle for host localhost: 0x256e460
* Re-using existing connection! (#0) with host localhost
* Connected to localhost (::1) port 8080 (#0)
> GET /manager/html;jsessionid=F3F2A25463ED1CD49E154FA5428B853A?org.apache.catalina.filters.CSRF_NONCE=B5CB272DF379F59A8158583826850550 HTTP/1.1
> User-Agent: curl/7.40.0
> Host: localhost:8080
> Accept: */*
>
< HTTP/1.1 401 Unauthorized
< Server: Apache-Coyote/1.1
< Cache-Control: private
< Expires: Thu, 01 Jan 1970 01:00:00 GMT
< WWW-Authenticate: Basic realm="Tomcat Manager Application"
< Content-Type: text/html;charset=ISO-8859-1
< Content-Length: 2474
< Date: Sun, 14 Jun 2015 08:47:27 GMT

修改apache-tomcat-8.0.23/conf/tomcat-users.xml文件後添加以下內容：

<role rolename="manager-gui"/>
<user username="tomcat" password="tomcat" roles="manager-gui"/>

並嘗試訪問上下文，這次使用身份驗證成功：

$ curl -v -L -utomcat:tomcat localhost:8080/manager/
*   Trying ::1...
* Connected to localhost (::1) port 8080 (#0)
* Server auth using Basic with user 'tomcat'
> GET /manager/ HTTP/1.1
> Authorization: Basic dG9tY2F0OnRvbWNhdA==
> User-Agent: curl/7.40.0
> Host: localhost:8080
> Accept: */*
>
< HTTP/1.1 302 Found
< Server: Apache-Coyote/1.1
< Set-Cookie: JSESSIONID=7890CA71EC221A152BDB4F04B66BE49E; Path=/manager/; HttpOnly
< Location: http://localhost:8080/manager/html;jsessionid=7890CA71EC221A152BDB4F04B66BE49E?org.apache.catalina.filters.CSRF_NONCE=92DAD506CB8E9E24E8454BBA94567F84
< Content-Type: text/html;charset=ISO-8859-1
< Content-Length: 0
< Date: Sun, 14 Jun 2015 08:48:09 GMT
<
* Connection #0 to host localhost left intact
* Issue another request to this URL: 'http://localhost:8080/manager/html;jsessionid=7890CA71EC221A152BDB4F04B66BE49E?org.apache.catalina.filters.CSRF_NONCE=92DAD506CB8E9E24E8454BBA94567F84'
* Found bundle for host localhost: 0x69e4c0
* Re-using existing connection! (#0) with host localhost
* Connected to localhost (::1) port 8080 (#0)
* Server auth using Basic with user 'tomcat'
> GET /manager/html;jsessionid=7890CA71EC221A152BDB4F04B66BE49E?org.apache.catalina.filters.CSRF_NONCE=92DAD506CB8E9E24E8454BBA94567F84 HTTP/1.1
> Authorization: Basic dG9tY2F0OnRvbWNhdA==
> User-Agent: curl/7.40.0
> Host: localhost:8080
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: Apache-Coyote/1.1
< Cache-Control: private
< Expires: Thu, 01 Jan 1970 01:00:00 GMT
< Set-Cookie: JSESSIONID=42B0B26688726A802B665B0B33D1690B; Path=/manager/; HttpOnly
< Content-Type: text/html;charset=utf-8
< Transfer-Encoding: chunked
< Date: Sun, 14 Jun 2015 08:48:09 GMT

現在，如果您嘗試使用不同的介面來執行請求（即 not localhost），無論您是否使用身份驗證，都會遇到 403 HTTP 錯誤：

$ curl --interface wlp6s0 -v -L -utomcat:tomcat localhost:8080/manager/
*   Trying ::1...
*   Trying 127.0.0.1...
* Local Interface wlp6s0 is ip 192.168.1.187 using address family 2
* SO_BINDTODEVICE wlp6s0 failed with errno 1: Operation not permitted; will do regular bind
* Local port: 0
* Connected to localhost (127.0.0.1) port 8080 (#0)
* Server auth using Basic with user 'tomcat'
> GET /manager/ HTTP/1.1
> Authorization: Basic dG9tY2F0OnRvbWNhdA==
> User-Agent: curl/7.40.0
> Host: localhost:8080
> Accept: */*
>
< HTTP/1.1 403 Forbidden
< Server: Apache-Coyote/1.1
< Set-Cookie: JSESSIONID=2F3ADE627300D4D264478927D1F0BBFC; Path=/manager/; HttpOnly
< Content-Type: text/html;charset=ISO-8859-1
< Content-Length: 3196
< Date: Sun, 14 Jun 2015 09:06:52 GMT
<

這是預期的，因為我們只限制訪問localhost。

簡而言之，如果收到 403 錯誤響應，請檢查 tomcat 正在偵聽的介面：

<Connector port="8080" protocol="HTTP/1.1"
          connectionTimeout="20000"
          redirectPort="8443" />

$ ss -tulpan | grep LISTEN.*8080

以及您用於請求的介面。

 tcp    LISTEN     0      100                   :::8080                 :::*      users:(("java",pid=32490,fd=48))

引用自：https://serverfault.com/questions/698679