1

I am trying to modify a Tomcat (7.0.52) valve definition to allow contact from a different server.

The valve definition looks like that shown below. Previously, it was a RemoteAddrValve and defined with 127.0.0.1 (to only allow access from local host). This worked perfectly. For the new definition the AddrValve was changed to a HostValve and the full-qualified-domain-name of the remote server was entered. Now when hitting that Tomcat instance from that remote server, I always get a Http 403: 'Access to the specified resource has been forbidden'.

<Context debug="0" swallowOutput="true">

    <!-- This causes session data to NOT be persisted to disk across tomcat restarts -->
    <Manager pathname=""/>

    <Valve className="org.apache.catalina.valves.AccessLogValve"
             directory="logs"  prefix="blackduck_solr_access_log." suffix=".txt"
             pattern='%{yyyy-MM-dd HH:mm:ss,SSS}t [%I] %h "%r" %s %b'/>

    <!-- JVCS-646 solr access to  localhost only -->
    <Valve className="org.apache.catalina.valves.RemoteHostValve"
            allow="FQDN_HERE" />
</Context>

I did not set this server up and am clearly not expert in Tomcat Security. The contents shown above were put into a file in this directory: ./tomcat/conf/Catalina/localhost

I know the file is being processed because I get errors if the syntax is not correct. Also if I remove it then access is wide open. Can anyone help with what might be wrong?

JoeG
  • 7,191
  • 10
  • 60
  • 105
  • Two points: 1) Is the hostname resolvable from the host tomcat is deployed to? 2) Are you aware that `allow=""` contains a regexp, not a a string? – Dirk Lachowski Jun 03 '14 at 11:34
  • #1. Fair point, yes, both ping and nslookup resolve the host just fine. #2. I know it is a regexp, but have been proceeding assuming the '.''s from the FQDN in the regex will match the 'period's in the actual FQDN. – JoeG Jun 03 '14 at 11:46
  • Is the 403ed access logged by the AccessLogValve? If so, matches the logged hostname the hostname from the RemoteHostValve? – Dirk Lachowski Jun 03 '14 at 12:05
  • I have the same problem in tomcat8 @see: http://stackoverflow.com/questions/42577035/tomcat-8-remotehostvalve-not-working did you try to add: `enableLookups="true"` ? – Radon8472 Mar 03 '17 at 12:59

0 Answers0