Prevent access to certain webapps in Tomcat6

Question

I asked this on server fault but really havent had much luck, hoping that someone here would be able to offer some advice...

I have a Tomcat 6 server running just fine. I have external access working. I wanted to know how to prevent someone from seeing specific webapps, for example, I dont want external access to the ROOT tomcat page. How would I go about preventing some webapps while leaving other webapps visible to external users ?

Here's what I've tried: This denies everything even 127.0.0.1 requests

<Host name="localhost"  appBase="webapps"
                unpackWARs="true" autoDeploy="true"
                xmlValidation="false" xmlNamespaceAware="false">

    <Context path="/examples" docBase="" >
       <Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="127.0.0.1"/>
    </Context>
  </Host>

This denies everything as well.

<Host name="localhost"  appBase="webapps"
                    unpackWARs="true" autoDeploy="true"
                    xmlValidation="false" xmlNamespaceAware="false">

        <Context path="/examples" docBase="" >
           <Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="*"/>
        </Context>
      </Host>

Basically I am trying to prevent access to the ROOT default tomcat page and the example apps....

Any ideas?

Answer 1

take a look at the documentation. http://tomcat.apache.org/tomcat-6.0-doc/config/valve.html

What you have seems to be correct. it says "If this attribute is specified, the remote address MUST match for this request to be accepted."

One thing you might look at is to see whether 127.0.0.1 is really the correct IP. You might be actually using the actual IP of the box. try adding that IP address after the localhost one.

Answer 2

You can't use a wild card for the allow attribute...on the other hand you can use one for the deny attribute.

<Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="*"/>

This is why I was getting a 403 with the above code.

Also another way I handled this was I created a jsp that redirected traffic to wherever I wanted.