Apache Tomcat Server is most popular open source web server with servlet container. It’s light wight web server and will not required much space in the system. Apache Tomcat server having a lot of of security vulnerabilities and we need to fix those to make secure web server. OWSAP list down critical security vulnerabilities with solution. You can go through here and learn how to make secure Apache Tomcat Server. Here I am going to sharing How to encrypt Apache Tomcat Server Admin’s Password, It’s very simple. By default Admin’s passwords are plain text format and these credentials are stored in tomcat-user.xml. Which is exist inside the conf folder under Tomcat installation folder.
Ex: <Tomcat-Installation>/Conf
Tomcat comes with a nice little app called the Web Application Manager, which makes it easy to deploy a new war-file. To be able to use the application you have to add an account with the role of “manager-gui”. This is done by adding the following two lines to the tomcat-users.xml
file:
<role rolename="manager-gui"/> <user username="admin" password="admin" roles="manager-gui"/>
Step 1
Go to command prompt, then go to tomcat installation directory till bin folder and execute the following command.
Tomcat comes with a script that allows us to encrypt passwords. This script is called digest.bat
on Windows or digest.sh
on Linux and can be found in the bin
directory. With this we can specify the encryption algorithm that we want to use – here we’re using SHA-256 – and we enter the text we want to encrypt:
D:\Tools\Apache\apache-tomcat-6.0.26\bin>digest.bat -a sha-256 admin123 admin123:240be518fabd2724ddb6f04eeb1da5967448d7e831c08c8fa822809f74c720a9 D:\Tools\Apache\apache-tomcat-6.0.26\bin>
Step 2
Replace the plain text password with the above encrypted password generated above in tomcat-user.xml file as follows.
<role rolename="manager-gui"/> <user username="admin" password="240be518fabd2724ddb6f04eeb1da5967448d7e831c08c8fa822809f74c720a9" roles="manager-gui"/>
Step 3
We have tell to Tomcat like password is encrypted by doing the changes in server.xml
<Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase" />
Change to
<Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase" digest="sha-256" />
Step 4
Then restart the Apache Tomcat Server and access the Manager Application and enter the user name and password to login.
References
https://www.owasp.org/index.php/Securing_tomcat
I hope you understood now to encrypt Apache Tomcat Server Admin’s Password. Please leave a reply in comment if you need any assistance.
Hello! I am Narayanaswamy founder and admin of narayanatutorial.com. I have been working in the IT industry for more than 12 years. NarayanaTutorial is my web technologies blog. My specialties are Java / J2EE, Spring, Hibernate, Struts, Webservices, PHP, Oracle, MySQL, SQLServer, Web Hosting, Website Development, and IAM(ForgeRock) Specialist
I am a self-learner and passionate about training and writing. I am always trying my best to share my knowledge through my blog.