The description below uses the variable name $CATALINA_HOME
to refer to the directory into which you have installed Tomcat 4,
and is the base directory against which most relative paths are
resolved. However, if you have configured Tomcat 4 for multiple
instances by setting a CATALINA_BASE directory, you should use
$CATALINA_BASE instead of $CATALINA_HOME for each of these
references.
It would be quite unsafe to ship Tomcat with default settings that allowed
anyone on the Internet to execute the Manager application on your server.
Therefore, the Manager application is shipped with the requirement that anyone
who attempts to use it must authenticate themselves, using a username and
password that have the role manager associated with them.
Further, there is no username in the default users file
($CATALINA_HOME/conf/tomcat-users.xml) that is assigned this
role. Therefore, access to the Manager application is completely disabled
by default.
To enable access to the Manager web application, you must either create
a new username/password combination and associate the role name
manager with it, or add the manager role
to some existing username/password combination. Exactly where this is done
depends on which Realm
implementation you are using:
- MemoryRealm - If you have not customized your
$CATALINA_HOME/conf/server.xml
to select a different one,
Tomcat 4 defaults to an XML-format file stored at
$CATALINA_HOME/conf/tomcat-users.xml
, which can be
edited with any text editor. This file contains an XML
<user>
for each individual user, which might
look something like this:
 |  |  |
 |
<user name="craigmcc" password="secret" roles="standard,manager" />
|  |
 |  |  |
which defines the username and password used by this individual to
log on, and the role names he or she is associated with. You can
add the manager role to the comma-delimited
roles
attribute for one or more existing users, and/or
create new users with that assigned role.
- JDBCRealm - Your user and role information is stored in
a database accessed via JDBC. Add the manager role
to one or more existing users, and/or create one or more new users
with this role assigned, following the standard procedures for your
environment.
- JNDIRealm - Your user and role information is stored in
a directory server accessed via LDAP. Add the manager
role to one or more existing users, and/or create one or more new users
with this role assigned, following the standard procedures for your
environment.
The first time you attempt to issue one of the Manager commands
described in the next section, you will be challenged to log on using
BASIC authentication. The username and password you enter do not matter,
as long as they identify a valid user in the users database who possesses
the role manager.
In addition to the password restrictions the manager web application
could be restricted by the remote IP address or host by adding a
RemoteAddrValve
or RemoteHostValve
. Here is
an example of restricting access to the localhost by IP address:
<Context path="/manager" debug="0" privileged="true"
docBase="/usr/local/kinetic/tomcat4/server/webapps/manager">
<Valve className="org.apache.catalina.valves.RemoteAddrValve"
allow="127.0.0.1"/>
</Context>