tomcat管理界面报403禁止错误

Question

我最近不得不配置两个 tomcat 服务器。我已经使用 8.5.13 版本设置了一个 tomcat 服务器，并且工作正常。我可以毫无问题地访问服务器状态、管理器应用程序和主机管理器 Web 界面。

但是当我尝试通过从我构建的 8.5.13 服务器复制相同的配置来设置运行 tomcat 版本 8.5.14 的新 tomcat 服务器时，我在服务器状态和管理器应用程序上收到拒绝访问 403。但奇怪的是只有 Host Manager Web 界面可以正常工作。我可以访问它。

我需要弄清楚为什么在第一台服务器上工作的相同配置在第二台服务器上给我 403 denied。

这是我每个人都有的：

工作服务器 Java：

java version "1.8.0_121"
Java(TM) SE Runtime Environment (build 1.8.0_121-b13)
Java HotSpot(TM) 64-Bit Server VM (build 25.121-b13, mixed mode)

非工作服务器有一个更新的 java:

java version "1.8.0_131"
Java(TM) SE Runtime Environment (build 1.8.0_131-b11)
Java HotSpot(TM) 64-Bit Server VM (build 25.131-b11, mixed mode)

就配置而言，其他一切都相同。

在 /etc/profile 中都有 java 和 tomcat 变量设置：

JAVA_HOME='/usr/lib/jvm'
CATALINA_HOME='/usr/local/tomcat'

export PATH USER LOGNAME MAIL HOSTNAME HISTSIZE HISTCONTROL JAVA_HOME CATALINA_HOME

两台服务器具有相同的配置文件，从第一个工作服务器复制到第二个非工作服务器。

Tomcat 用户配置：

cat /usr/local/tomcat/conf/tomcat-users.xml
<tomcat-users>
    <user username="admin" password="not_saying" roles="manager-gui,admin-gui"/>
</tomcat-users>

上下文配置文件有这样的：

 cat /usr/local/tomcat/conf/context.xml
<?xml version="1.0" encoding="UTF-8"?>
<!--
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->
<!-- The contents of this file will be loaded for each web application -->
<Context antiResourceLocking="false" privileged="true" >
<!--  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
               allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" /> -->
</Context>

两个 tomcat 的 webapps context.xml 配置都有这个：

cat /usr/local/tomcat/webapps/host-manager/META-INF/context.xml
<?xml version="1.0" encoding="UTF-8"?>
<!--
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->
<Context antiResourceLocking="false" privileged="true" >
<!--  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
               allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" /> -->
</Context>

为什么 tomcat 服务器 1（版本 8.5.13）可以工作，而服务器 2 上较新的 tomcat 版本（8.5.14）不工作？

Answer 1

您能否确认您正在尝试从 localhost 以外的机器访问它并且您没有注释掉 manager/META-INF/context.xml 中的 RemoteAddrValve 限制？您从 host-manager 的 context.xml 中显示了一个 sn-p，它被注释掉并说您可以访问 host-manager，但并没有真正确认您对 manager webapp 做了同样的事情。