Tomcat安全

部署安装tomcat

[root@tomcat ~]# tar -zxf apache-tomcat-8.0.30.tar.gz 
[root@tomcat ~]# mv apache-tomcat-8.0.30 /usr/local/tomcat
[root@tomcat ~]# /usr/local/tomcat/bin/startup.sh 
[root@tomcat ~]# netstat -pntul | grep :8080
tcp6       0      0 :::8080                 :::*            LISTEN      18454/java        
[root@tomcat ~]# echo "welcome to tomcat"  > /usr/local/tomcat/webapps/ROOT/test.html
[root@tomcat ~]# curl http://localhost:8080/test.html
welcome to tomcat

当访问没有的页面时,会显示版本信息,不利于安全

[root@tomcat ~]# curl http://localhost:8080/xxx  
<!DOCTYPE html><html><head><title>Apache Tomcat/8.0.30...

屏蔽版本信息(影响浏览器)

[root@tomcat ~]# /usr/local/tomcat/bin/shutdown.sh 
[root@tomcat ~]# netstat -pntul | grep :8080
[root@tomcat ~]# yum -y install java-1.8.0-openjdk-devel
[root@tomcat ~]# java -version
openjdk version "1.8.0_131"
OpenJDK Runtime Environment (build 1.8.0_131-b12)
OpenJDK 64-Bit Server VM (build 25.131-b12, mixed mode)
[root@tomcat ~]# cd /usr/local/tomcat/lib/
[root@tomcat lib]# ls
annotations-api.jar       jasper-el.jar       tomcat-i18n-fr.jar
catalina-ant.jar          jasper.jar          tomcat-i18n-ja.jar
catalina-ha.jar           jsp-api.jar         tomcat-jdbc.jar
catalina.jar              servlet-api.jar     tomcat-jni.jar
catalina-storeconfig.jar  tomcat-api.jar      tomcat-util.jar
catalina-tribes.jar       tomcat-coyote.jar   tomcat-util-scan.jar
ecj-4.4.2.jar             tomcat-dbcp.jar     tomcat-websocket.jar
el-api.jar                tomcat-i18n-es.jar  websocket-api.jar
[root@tomcat lib]# jar -xf catalina.jar 
[root@tomcat lib]# jar -xf catalina.jar 
[root@tomcat lib]# ls
catalina-ha.jar           META-INF            tomcat-jdbc.jar
catalina.jar              org                 tomcat-jni.jar
...
[root@tomcat lib]# vim org/apache/catalina/util/
CharsetMapperDefault.properties  ServerInfo.properties
LocalStrings.properties          
[root@tomcat lib]# vim org/apache/catalina/util/ServerInfo.properties 
...
server.info=welcome                 //改动=后面的,名称自定义
server.number=welcome               //改动=后面的,名称自定义
server.built=Dec 1 2015 22:30:46 UTC

[root@tomcat lib]# /usr/local/tomcat/bin/startup.sh 
[root@tomcat lib]# curl http://localhost:8080/xxx
<!DOCTYPE html><html><head><title>welcome...                //显示的是改动之后的名字

修改主配置文件,命令行下显示输出信息也不为apache

[root@tomcat lib]# curl -I  http://localhost:8080/test   //访问不存在的页面
HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=utf-8
Content-Language: en
Content-Length: 980
Date: Thu, 03 Jan 2019 07:49:02 GMT
[root@tomcat lib]# /usr/local/tomcat/bin/shutdown.sh 

[root@tomcat lib]# vim /usr/local/tomcat/conf/server.xml 
 69     <Connector port="8080" protocol="HTTP/1.1"
 70                connectionTimeout="20000"
 71                redirectPort="8443" server="please don't look at me" />   //添加server
[root@tomcat lib]# /usr/local/tomcat/bin/startup.sh 
[root@tomcat lib]# netstat -pntul | grep :8080
tcp6       0      0 :::8080                 :::*          LISTEN      19374/java          
[root@tomcat lib]# curl -I  http://localhost:8080/test
HTTP/1.1 404 Not Found
Content-Type: text/html;charset=utf-8
Content-Language: en
Content-Length: 978
Date: Thu, 03 Jan 2019 07:59:29 GMT
Server: please don't look at me                      //显示的就是我们更改的内容

降权运行 (用root用户可以访问系统所有的文件,不利于安全维护)

[root@tomcat ~]# ps aux | grep java               //进程显示的用户是root
root     19374  1.2  8.1 2299208 83276 pts/0   Sl   15:58 ....
[root@tomcat ~]# /usr/local/tomcat/bin/shutdown.sh 
[root@tomcat ~]# useradd tomcat
[root@tomcat ~]# chown -R tomcat:tomcat /usr/local/tomcat/
[root@tomcat ~]# su - tomcat -c "/usr/local/tomcat/bin/startup.sh"
[root@tomcat ~]# netstat -pntul | grep :8080
tcp6       0      0 :::8080                 :::*             LISTEN      19659/java          
[root@tomcat ~]# ps aux | grep java
tomcat   19659  7.4  7.6 2297008 77764 ?    Sl   16:13   0:02   //可以看到用户是tomcat
[root@tomcat ~]# vim /etc/rc.local                //添加到开机启动文件
su -c /usr/local/tomcat/bin/startup.sh  tomcat
[root@tomcat ~]# chmod +x /etc/rc.local            //添加执行权限

 

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值