Tomcat Server Configuration Automation Reinforcement(undone)

0. 引言
1. 黑客针对WEB Server会有那些攻击面
2. 针对Tomcat Server可以做的安全加固
3. Managing Security Realms with JMX
4. 实现对TOMCAT配置信息的动态修改(hot dynamic edit)
5. Tomcat后台manager页面禁用

1. 使用加固后的标准版的配置文件(config file)对原始文件进行替换
2. 对配置文件替换操作需要实现回滚操作
3. 对配置文件进行加固后，需要能立刻生效，并对当前服务器的业务运行产生尽量少的影响
    1) 配置文件热加载(hot reload)
    2) 重启web server

1. 使用WEB Server默认的账户
    1) tomcat默认安装后，后台管理界面的登录采用basic authentication的身份验证方式，而这个默认的账户是系统默认设置的tomcat、tomcat(在tomcat-users.xml文件中)

2. 帐户密码很弱或者没有  
    1) IIS使用内置或默认帐户。黑客一般会寻找这些帐户。如果这些账户没有从系统中删除的话，就会被发现并被更改
    2) 用户为了方便管理，常常在tomcat的后台管理界面的basic authentication登录中使用弱口令，很容易遭到黑客的暴力破解

3. 大量的开放端口 
每一位访问者，无论是善意还是恶意，都可以通过开放端口连接到站点和系统。在默认情况下，Windows与IIS的开放端口远远多于为了正常运行所需的端口。保持系统的开放端口应该保持最少数量，这一点很重要。所有其他的端口都需要关闭。
    1) Windows License Logging Service溢出 
　　    通过发送一条经过特殊格式化的信息到运行License Logging Service的Web服务器，黑客能够对未检查的缓冲区进行攻击。这可以导致服务失效，为黑客打开一个开放端口，从而使用“System”权限在服务器上执行代码。  
　　    2) 微软服务器信息块(SMB)漏洞
　　    服务器信息块协议被Windows用于文件和打印机的共享以及计算机之间的通信。黑客的SMB服务器可以利用这项功能来使用"System"权限，对客户机执行任意代码。
　　
4. 服务器扩展、模块的漏洞
    1) ISAPI扩展缓冲区溢出
　　    IIS安装后，就会自动安装多个Internet ISAPI服务器扩展。ISAPI服务器扩展实际上是动态链接库(DLL)，是用来增强IIS服务器的功能的。一些动态链接库，比如idq.dll ，包含编程错误，可让黑客发送数据到ISAPI服务器扩展，这就是"缓冲区溢出"攻击 因此，攻                
 
5. WEB脚本漏洞
针对WEB脚本(asp、php、jsp)的攻击原则上来说是代码层的攻击，但是从纵深防御的原则上来看，我们在服务器的代码执行层面也是可以部署一些限制的
    1) 利用执行路径限制，将当前web路径强制限定在某个路径下
    2) API白名单、黑名单限制

http://www.searchsecurity.com.cn/showcontent_11382.htm
http://www.searchsecurity.com.cn/guide/webseversetting.htm

1. 后台管理页面(manager管理界面)basic authentication登录弱口令强化
帮助用户解决弱口令问题

2. 禁用后台管理页面(manager管理界面)
在大多数生产情况下，manager页面是不需要的

3. 禁用tomcat manager管理界面的WAR Remote Deploy远程部署
通过后台管理界面的WAR部署接口进行GETSHELL是黑客常用的手段

4. 禁止列目录(index travel)

http://www.cnblogs.com/LittleHann/p/3567908.html
http://www.cnblogs.com/LittleHann/p/3541989.html
http://www.cnblogs.com/LittleHann/p/3543681.html

1. UserDatabaseRealm
//className="org.apache.catalina.realm.UserDatabaseRealm"
UserDatabaseRealm is an implementation of the Tomcat Realm interface that uses a JNDI resource to store user information. By default, the JNDI resource is backed by an XML file. It is not designed for large-scale production use. At startup time, the UserDatabaseRealm loads information about all users, and their corresponding roles, from an XML document (by default, this document is loaded from $CATALINA_BASE/conf/tomcat-users.xml). The users, their passwords and their roles may all be editing dynamically, typically via JMX. Changes may be saved and will be reflected in the XML file.
对于使用 的身份验证，可以使用JMX API接口动态的修改tomcat的身份认证配置，并自动映射到磁盘上的配置文件tomcat-users.xml

2. JDBCRealm
//className="org.apache.catalina.realm.JDBCRealm
JDBCRealm is an implementation of the Tomcat Realm interface that looks up users in a relational database accessed via a JDBC driver. There is substantial configuration flexibility that lets you adapt to existing table and column names, as long as your database structure conforms to the following requirements:
    1) There must be a table, referenced below as the users table, that contains one row for every valid user that this Realm should recognize.
    2) The users table must contain at least two columns (it may contain more if your existing applications required it):
    3) Username to be recognized by Tomcat when the user logs in. Password to be recognized by Tomcat when the user logs in. This value may in cleartext or digested 
    4) The user roles table must contain at least two columns (it may contain more if your existing applications required it):
        4.1) Username to be recognized by Tomcat ( 
        4.2) 2014/10/27Role name of a valid role associated with this user.
    /*
    create table users (
      user_name         varchar(15) not null primary key,
      user_pass         varchar(15) not null
    );

    create table user_roles (
      user_name         varchar(15) not null,
      role_name         varchar(15) not null,
      primary key (user_name, role_name)
    );
    */
When a user attempts to access a protected resource for the first time, Tomcat will call the authenticate() method of this Realm. Thus, any changes you have made to the database directly (new users, changed passwords or roles, etc.) will be immediately reflected.
对于JDBCRealm来说，对保存账户信息的数据库的修改，会实时的映射到tomcat中
      
3. DataSourceRealm
//className="org.apache.catalina.realm.DataSourceRealm"
DataSourceRealm is an implementation of the Tomcat Realm interface that looks up users in a relational database accessed via a JNDI(JNDI(Java Naming and Directory Interface,Java命名和目录接口) named JDBC DataSource. 
本质上和JDBCRealm认证原理类似，差别在于使用JNDI接口进行数据源数据获取

4. JNDIRealm
//className="org.apache.catalina.realm.JNDIRealm"
JNDIRealm is an implementation of the Tomcat Realm interface that looks up users in an LDAP directory server accessed by a JNDI provider (typically, the standard LDAP provider that is available with the JNDI API classes). The realm supports a variety of approaches to using a directory for authentication.

5. MemoryRealm
MemoryRealm is a simple demonstration implementation of the Tomcat Realm interface. It is not designed for production use. At startup time, MemoryRealm loads information about all users, and their corresponding roles, from an XML document (by default, this document is loaded from $CATALINA_BASE/conf/tomcat-users.xml). Changes to the data in this file are not recognized until Tomcat is restarted.

6. JAASRealm
//className="org.apache.catalina.realm.JAASRealm"
JAASRealm is an implementation of the Tomcat Realm interface that authenticates users through the Java Authentication & Authorization Service (JAAS) framework which is now provided as part of the standard Java SE API.

7. CombinedRealm
//className="org.apache.catalina.realm.CombinedRealm"
CombinedRealm is an implementation of the Tomcat Realm interface that authenticates users through one or more sub-Realms.
Using CombinedRealm gives the developer the ability to combine multiple Realms of the same or different types. This can be used to authenticate against different sources, provide fall back in case one Realm fails or for any other purpose that requires multiple Realms.
Sub-realms are defined by nesting Realm elements inside the Realm element that defines the CombinedRealm. Authentication will be attempted against each Realm in the order they are listed. Authentication against any Realm will be sufficient to authenticate the user.

8. LockOutRealm
//className="org.apache.catalina.realm.LockOutRealm"
LockOutRealm is an implementation of the Tomcat Realm interface that extends the CombinedRealm to provide lock out functionality to provide a user lock out mechanism if there are too many failed authentication attempts in a given period of time.
To ensure correct operation, there is a reasonable degree of synchronisation in this Realm.
This Realm does not require modification to the underlying Realms or the associated user storage mechanisms. It achieves this by recording all failed logins, including those for users that do not exist. To prevent a DOS by deliberating making requests with invalid users (and hence causing this cache to grow) the size of the list of users that have failed authentication is limited.
Sub-realms are defined by nesting Realm elements inside the Realm element that defines the LockOutRealm. Authentication will be attempted against each Realm in the order they are listed. Authentication against any Realm will be sufficient to authenticate the user.

...
<Realm className="org.apache.catalina.realm.LockOutRealm">
    <!-- This Realm uses the UserDatabase configured in the global JNDI
         resources under the key "UserDatabase".  Any edits
         that are performed against this UserDatabase are immediately
         available for use by the Realm.  -->
    <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>
</Realm>
...

public class UserDatabaseRealm
extends RealmBase
//Implementation of Realm that is based on an implementation of UserDatabase made available through the global JNDI resources configured for this instance of Catalina. Set the resourceName parameter to the global JNDI resources name for the configured instance of UserDatabase that we should consult.

1. manager-gui
allows access to the HTML GUI and the status pages
也就是我们常用到的
http://localhost:8080/manager/html

2. manager-script
allows access to the text interface and the status pages

3. manager-jmx
allows access to the JMX proxy and the status pages

4. manager-status
allows access to the status pages only

1. 将tomcat-users.xml中的<user .../>节点中，设置为"manager-gui"的账户全部修改为"tomcat"
因为只有manager-gui这个role才具有访问tomcat web后台界面的权限，因此，这样实现对tomcat后台页面的禁用

2. 修改403.jsp页面
对tomcat-users.xml文件进行修改后，管理员在使用原始的帐号密码登录后台的时候，会被Realm验证模块拒绝，显示403.jsp页面。我们需要在这个页面显示我们的修复动作和可能产生的后果，并告知修改回滚的接口地址

3. 修复消息通知推送
通过手机短信的方式通知到管理员tomcat的后台管理界面已经被禁用

http://tomcat.apache.org/tomcat-8.0-doc/index.html
http://tomcat.apache.org/tomcat-8.0-doc/realm-howto.html
http://www.cnblogs.com/lanhuahua/archive/2011/08/10/2133685.html
http://blog.csdn.net/feng88724/article/details/7164983
https://tomcat.apache.org/tomcat-7.0-doc/api/org/apache/catalina/realm/UserDatabaseRealm.html

<init-param>
    <param-name>listings</param-name>
    <param-value>false</param-value>
</init-param>

//IIS API automatic config相关知识请参阅
http://www.cnblogs.com/LittleHann/p/3988923.html

1. the Instrumentation Level
The Instrumentation Level contains the components and resources that you would like to manage.  These resources are represented by one or more specialized JavaBeans known as Managed Beans, or MBeans for short
MBeans are Java Beans that implement additional components which allow them to be managed and monitored via the JMX framework.  Each MBean represents a single resource running on the JVM, which is exposed for remote management using JMX.
在这一层就是所谓的providers MBeans

2. the Agent Level
There are a few different types of MBeans, each with different functionalities, which offer a greater degree flexibility when designing your administrative framework.  Any MBean that you wish to expose is registered with the MBeanServer, which makes up JMX‘s Agent Level.
The Agent Level is composed of an intermediate agent called MBeanServer.  The job of this layer is to receive requests or commands from the Remote Management Level, and relay them to the appropriate MBean.  It also can receive notifications from its MBeans, such as state changes, and forward them to the Remote Management Layer.
在这一层就是所谓的security service(APIS)

3. the Remote Management Level    
The Remote Management Layer is made up of client programs, connectors, and adaptors, and allows the user to send requests to the Agent layer for relay and receive the results of these requests.  Users can connect to the MBeanServer either 
    1) through a connector, using a client program such as JConsole and a protocol such as RMI or IIOP
    对应于tomcat-users.xml中的manager-jmx role

    2) or through an adaptor, which adapts the MBeanServer API to another protocol, such as HTTP, allowing JMX to be used with custom web-based GUIs.
    对应于tomcat-users.xml中的manager-gui role
In summary, a user at the Remote Management Level sends a request or command to the Agent Level, which contacts the appropriate MBean at the Instrumentation Level, and relays the response back to the user. 

1. create a JMX client that uses the providers in a realm to add or remove security data such as users and groups. 
2. You can also create a client that adds or removes providers
3. makes other changes to the realm configuration.

1. the set of MBean types that are available in a security realm depends on which security providers you have installed in the realm
2. the set of services that each security provider enables depends on how the provider was created.

security providers -> security realm(一个realm可以包含多个providers) -> MBean Proxy -> security service(APIS) 

1. DefaultAuthorizerMBean extends AuthorizerMBean
2. any custom or third-party authorization provider also extends AuthorizerMBean. 
//If a JMX client gets the value of the RealmMBean Authorizers attribute, the MBean server returns all MBeans in the realm that extend AuthorizerMBean. The JMX client can iterate through the list of providers and select one based on the value of its Name attribute or other criteria.

1. if an authentication provider extends the UserEditorMBean, then the provider can add users to the realm.

1. AuthenticationProviderMBean
The base MBean for all MBean implementations that manage Authentication providers. If your Authentication provider uses the WebLogic Security SSPI to provide login services, then your MBean must extend weblogic.management.security.authentication.Authenticator. If your Authentication provider uses the WebLogic Security SPI to provide identity-assertion services, then your MBean must extend weblogic.management.security.authentication.IdentityAsserter.
 
2. AuthenticatorMBean
The SSPI MBean that all Authentication providers with login services must extend. This MBean provides a ControlFlag to determine whether the Authentication provider is a REQUIRED, REQUISITE, SUFFICENT, or OPTIONAL part of the login sequence.

3. IdentityAsserterMBean
The SSPI MBean that all Identity Assertion providers must extend. This MBean enables an Identity Assertion provider to specify the token types for which it is capable of asserting identity.

4. ServletAuthenticationFilterMBean
The SSPI MBean that all Servlet Authentication Filter providers must extend. This MBean is just a marker interface. It has no methods on it.

....
1. UserEditorMBean：Provides a set of methods for creating, editing, and removing users
2. UserReaderMBean：Provides a set of methods for reading data about users.
3. RoleEditorMBean：Provides a set of methods for creating, editing, and removing roles.  
4. RoleReaderMBean：Provides a set of methods for reading roles.
...

1. HTTP URL方式：tomcat manager内置了一个轻量级的JMP HTTP Proxy
2. 使用java编写client connector/adaptor客户端程序

1. JMX Query command
    1) look for a specific MBean by the given name
    http://localhost:8080/manager/jmxproxy/?qry=Catalina%3Atype%3DEnvironment%2Cresourcetype%3DGlobal%2Cname%3DsimpleValue 
    2) locate all workers which can process requests and report their state
    http://localhost:8080/manager/jmxproxy/?qry=*%3Atype%3DRequestProcessor%2C* 
    3) return all loaded servlets
    http://localhost:8080/manager/jmxproxy/?qry=*%3Aj2eeType=Servlet%2c*

2. JMX Get command
    1) fetch the value of a specific MBean‘s attribute
    http://localhost:8080/manager/jmxproxy/?get=BEANNAME&att=MYATTRIBUTE&key=MYKEY
    2) fetch the current heap memory data:
    http://localhost:8080/manager/jmxproxy/?get=java.lang:type=Memory&att=HeapMemoryUsage
    3) fetch the current heap memory data and only want the "used" key
    http://localhost:8080/manager/jmxproxy/?get=java.lang:type=Memory&att=HeapMemoryUsage&key=used

3. JMX Set command
    1) general format
    http://localhost:8080/manager/jmxproxy/?set=BEANNAME&att=MYATTRIBUTE&val=NEWVALUE
    2) turn up debugging on the fly for the ErrorReportValve
    http://localhost:8080/manager/jmxproxy/?set=Catalina%3Atype%3DValve%2Cname%3DErrorReportValve%2Chost%3Dlocalhost&att=debug&val=10

4. JMX Invoke command
The invoke command enables methods to be called on MBeans
    1) general format
    http://localhost:8080/manager/jmxproxy/?invoke=BEANNAME&op=METHODNAME&ps=COMMASEPARATEDPARAMETERS
    2) call the findConnectors() method of the Service use
    http://localhost:8080/manager/jmxproxy/?invoke=Catalina%3Atype%3DService&op=findConnectors&ps=
    3) 修改指定用户的密码
    http://localhost:8080/manager/jmxproxy/?set=Users:type=User,username="test",database=UserDatabase&att=password&val=hello
    //将test这个账户的密码修改为hello

http://docs.oracle.com/cd/E11035_01/wls100/secintro/index.html
http://docs.oracle.com/cd/E11035_01/wls100/jmx/accessWLS.html#wp1112969
http://tomcat.apache.org/tomcat-8.0-doc/manager-howto.html#Using_the_JMX_Proxy_Servlet
http://tomcat.apache.org/tomcat-8.0-doc/manager-howto.html
http://tomcat.apache.org/tomcat-8.0-doc/realm-howto.html#MemoryRealm
http://docs.oracle.com/cd/E11035_01/wls100/jmx/editsecurity.html
http://www.360doc.com/content/10/1005/14/39755_58581727.shtml

1. 先修改Tomcat的启动脚本
    1) windows下为bin/catalina.bat
    2) linux下为catalina.sh
添加以下内容
set JMX_REMOTE_CONFIG=-Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=8999 -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=false  
set CATALINA_OPTS=%CATALINA_OPTS% %JMX_REMOTE_CONFIG%  
/*
1. 8999是jmxremote使用的端口号
2. 第二个false表示不需要鉴权
*/

2. 要注意以上语句的位置不能太后面
大概在200行左右这个位置就可以了，太前面也不行

3. 启动/重启tomcat
    1) D:\tomcat\apache-tomcat-8.0.14\bin
    2) catalina.bat run

import java.util.HashMap;
import java.util.Map;
import javax.management.MBeanServerConnection;
import javax.management.ObjectName;
import javax.management.remote.JMXConnector;
import javax.management.remote.JMXConnectorFactory;
import javax.management.remote.JMXServiceURL;

public class JMXTest 
{ 
    public static void main(String[] args)
    {
        try 
        {
           String jmxURL = "service:jmx:rmi:///jndi/rmi://127.0.0.1:8999/jmxrmi";//tomcat jmx url
           /*
             * JMXServiceURL用于标识JMXConnectorServer，它是采用以下形式的字符串
             * service:jmx:<protocol>://[[[ <host>]: <port>]/ <path>]
                    1. "protocol" 
                    指定了协议，例如
                        1) rmi
                        2) iiop
                        3) jmxmp
                        4) soap
                    2. "host"(可选)
                    3. "port"(可选)
                    4. "path"(可选)
            */
           JMXServiceURL serviceURL = new JMXServiceURL(jmxURL);
           
           Map<String, String[]> map = new HashMap<String, String[]>();
           String[] credentials = new String[] { "monitorRole" , "QED" };
           map.put("jmx.remote.credentials", credentials);
           /*
             * The client end of a JMX API connector. An object of this type can be used to establish a connection to a connector server.
             * A newly-created object of this type is unconnected. Its connect method must be called before it can be used. However, objects created by JMXConnectorFactory.connect are already connected.
           */
           JMXConnector conneactor = JMXConnectorFactory.connect(serviceURL, map);
           MBeanServerConnection  mbsc = conneactor.getMBeanServerConnection();
           
           /*
           ObjectName threadObjNameSet = new ObjectName("Catalina:type=Valve,host=localhost,context=/host-manager,name=BasicAuthenticator");
           Attribute attrVal = new Attribute("stateName", "STOPED");
           mbsc.setAttribute(threadObjNameSet, attrVal);
           */
           
           /*
            * 填写需要获取的ObjectName对象名，即MBeans Idntifier
           */
           ObjectName threadObjName = new ObjectName("Catalina:type=Valve,host=localhost,context=/host-manager,name=BasicAuthenticator");
           String attrName = "stateName";  
           //通过MBeans的getter方法获取对应的属性值
           System.out.println("password: " + mbsc.getAttribute(threadObjName, attrName));            
        }
        catch (Exception e)
        {
            e.printStackTrace();
        }
    } 
}

http://localhost:8080/manager/jmxproxy/?get=Catalina:type=Valve,host=localhost,context=/host-manager,name=BasicAuthenticator&att=stateName
result:
OK - Attribute get ‘Catalina:type=Valve,host=localhost,context=/host-manager,name=BasicAuthenticator‘ - stateName = STARTED

http://whitesock.iteye.com/blog/246186
http://www.programcreek.com/java-api-examples/index.php?api=javax.management.MBeanServerConnection
http://pic.dhe.ibm.com/infocenter/wxsinfo/v8r6/index.jsp?topic=%2Fcom.ibm.websphere.extremescale.doc%2Ftxsmbeanprog.html
http://blog.csdn.net/airobot008/article/details/3951524
http://sharpspeed.iteye.com/blog/2009770
http://www.blogjava.net/japper/archive/2012/09/05/387092.html

1. HTTP URL JMXPROXY 
通过这种方式对tomcat的配置进行动态修改存在如下几个条件、限制
    1) 调用URL接口的用户必须本身是具有"manager-jmx"的角色，并且需要处于登录后的状态才可以调用这个接口
    2) tomcat的MBeans大多数不提供setter接口，而只提供getter接口，很多的设置是不能修改的，例如
        2.1) 取消basic认证
        2.2) 修改账户的role角色

2. JAVA CLIENT JXMPROXY API
通过这种方式对tomcat的配置进行动态修改存在如下几个条件、限制
    1) 需要tomcat服务端开启了JMXPROXY端口监听服务，而tomcat默认是不开启这个端口监听的，需要手动设置并重启
    2) tomcat的MBeans大多数不提供setter接口，而只提供getter接口，很多的设置是不能修改的，例如
        2.1) 取消basic认证
        2.2) 修改账户的role角色

1. 直接删除manager页面对应的jsp文件、manager目录
2. 研究一下tomcat的第三方监听器模块编写，向tomcat动态注册一个监听暴力破解事件的模块来阻断对后台manager页面的暴力破解
3. 对磁盘上的tomcat-users.xml文件的修复还是要的，尽管这需要等到用户自己下次重启的时候才会生效
    1) 将若密码修改为强密码
    2) 取消用户的manager-gui，即降权，达到禁止用户访问manager页面的目的 
5. 仅仅修改tomcat下的manager应用的web.xml文件，达到禁用basic authentication、或者禁止登录效果后，重启这个应用(manager)即可

http://man.chinaunix.net/newsoft/Apache2.2_chinese_manual/howto/htaccess.html

<?xml version="1.0" encoding="UTF-8"?> 
<web-app xmlns="http://java.sun.com/xml/ns/j2ee" 
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
        xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd" 
        version="2.4"> 

        <!-- ========================================================== --> 
        <!-- General --> 
        <!-- ========================================================== --> 

        <!-- Name the application --> 
        <display-name>Example App</display-name> 
        <description>An example application which is used to play with some of the features of Tomcat</description> 

        <!-- This app is cluster-ready --> 
        <distributable /> 

        <!-- Set timeout to 120 minutes --> 
        <session-config> 
                <session-timeout>120</session-timeout> 
        </session-config> 


        <!-- ========================================================== --> 
        <!-- Custom Tag Libraries --> 
        <!-- ========================================================== --> 

        <!-- Taglib declarations are no longer required since JSP 2.0, see Removing taglib from web.xml --> 
        <!-- The <taglib> did not need to be a child of <jsp-config> in earlier versions but is required as of Tomcat 7 --> 
        <!-- Note that you can only have one <jsp-config> element per web.xml --> 
        <!-- 
        <jsp-config> 
                <taglib> 
                        <taglib-uri>mytags</taglib-uri> 
                        <taglib-location>/WEB-INF/jsp/mytaglib.tld</taglib-location> 
                </taglib> 
        </jsp-config> 
        --> 


        <!-- ========================================================== --> 
        <!-- JSP Configuration --> 
        <!-- ========================================================== --> 

        <jsp-config> 
                <jsp-property-group> 
                        <url-pattern>*.jsp</url-pattern> 
                        <include-prelude>/WEB-INF/jspf/prelude1.jspf</include-prelude> 
                        <include-coda>/WEB-INF/jspf/coda1.jspf</include-coda> 
                </jsp-property-group> 
        </jsp-config> 


        <!-- ========================================================== --> 
        <!-- Context Parameters --> 
        <!-- ========================================================== --> 

        <context-param> 
                <description>Enable debugging for the application</description> 
                <param-name>debug</param-name> 
                <param-value>true</param-value> 
        </context-param> 
        <context-param> 
                <description>The email address of the administrator, used to send error reports.</description> 
                <param-name>webmaster</param-name> 
                <param-value>address@somedomain.com</param-value> 
        </context-param> 


        <!-- ========================================================== --> 
        <!-- JNDI Environment Variables --> 
        <!-- ========================================================== --> 

        <env-entry> 
                <env-entry-name>webmasterName</env-entry-name> 
                <env-entry-value>Ms. W. Master</env-entry-value> 
                <env-entry-type>java.lang.String</env-entry-type> 
        </env-entry> 
        <env-entry> 
                <env-entry-name>cms/defaultUserSettings/recordsPerPage</env-entry-name> 
                <env-entry-value>30</env-entry-value> 
                <env-entry-type>java.lang.Integer</env-entry-type> 
        </env-entry> 
        <env-entry> 
                <env-entry-name>cms/enableXMLExport</env-entry-name> 
                <env-entry-value>false</env-entry-value> 
                <env-entry-type>java.lang.Boolean</env-entry-type> 
        </env-entry> 
        <env-entry> 
                <env-entry-name>cms/enableEmailNotifications</env-entry-name> 
                <env-entry-value>true</env-entry-value> 
                <env-entry-type>java.lang.Boolean</env-entry-type> 
        </env-entry> 


        <!-- ========================================================== --> 
        <!-- Servlets --> 
        <!-- ========================================================== --> 

        <!-- Simple Servlet, provide a name, class, description and map to URL /servlet/SimpleServlet --> 
        <servlet> 
                <servlet-name>Simple</servlet-name> 
                <servlet-class>SimpleServlet</servlet-class> 
                <description>This is a simple Hello World servlet</description> 
        </servlet> 
        <servlet-mapping> 
                <servlet-name>Simple</servlet-name> 
                <url-pattern>/servlet/SimpleServlet</url-pattern> 
        </servlet-mapping> 

        <!-- CMS Servlet, responds to *.cms URL‘s --> 
        <servlet> 
                <!-- Identification --> 
                <servlet-name>cms</servlet-name> 
                <servlet-class>com.metawerx.servlets.ContentManagementSystem</servlet-class> 
                <description>This servlet handles requests for the CMS (it is a controller in an MVC architecture)</description> 

                <!-- This servlet has two parameters --> 
                <init-param> 
                        <param-name>debug</param-name> 
                        <param-value>true</param-value> 
                </init-param> 
                <init-param> 
                        <param-name>detail</param-name> 
                        <param-value>2</param-value> 
                </init-param> 

                <!-- Load this servlet when the application starts (call the init() method of the servlet) --> 
                <load-on-startup>5</load-on-startup> 
                <!-- <run-at>0:00, 6:00, 12:00, 18:00</run-at> This tag is only valid for Resin --> 
        </servlet> 

        <!-- Map some URLs to the cms servlet (demonstrates *.extension mapping) --> 
        <servlet-mapping> 
                <!-- For any URL ending in .cms, the cms servlet will be called --> 
                <servlet-name>cms</servlet-name> 
                <url-pattern>*.cms</url-pattern> 
        </servlet-mapping> 

        <!-- Rewriter Servlet, responds to /content/* and /admin/RewriterStatistics URL‘s --> 
        <!-- Define a servlet to respond to /content/* URL‘s --> 
        <servlet> 
                <servlet-name>rewriter</servlet-name> 
                <servlet-class>com.metawerx.servlets.URLRewriter</servlet-class> 
        </servlet> 

        <!-- Map some URL‘s to the rewriter servlet (demonstrates /path/* and specific URL mapping) --> 
        <servlet-mapping> 
                <!-- For any URL starting with /content/, the rewriter servlet will be called --> 
                <servlet-name>rewriter</servlet-name> 
                <url-pattern>/content/*</url-pattern> 
        </servlet-mapping> 
        <servlet-mapping> 
                <!-- The rewriter servlet can also be called directly as /admin/RewriterStatistics, to return stats --> 
                <servlet-name>rewriter</servlet-name> 
                <url-pattern>/admin/RewriterStatistics</url-pattern> 
        </servlet-mapping> 

        <!-- PathJSP Servlet, maps /shop/item/* URL‘s to a JSP file --> 
        <!-- Define a JSP file to respond to /shop/item/* URL‘s --> 
        <servlet> 
                <servlet-name>pathjsp</servlet-name> 
                <jsp-file>pathfinder.jsp</jsp-file> 
        </servlet> 

        <!-- Map some URL‘s to the pathjsp servlet (demonstrates /long/path/* URL mapping) --> 
        <servlet-mapping> 
                <!-- For any URL starting with /shop/item/, the pathjsp servlet will be called --> 
                <servlet-name>pathjsp</servlet-name> 
                <url-pattern>/shop/item/*</url-pattern> 
        </servlet-mapping> 


        <!-- ========================================================== --> 
        <!-- Filters --> 
        <!-- ========================================================== --> 

        <!-- Example filter to set character encoding on each request (from Tomcat servlets-examples context) --> 
        <filter> 
                <filter-name>Set Character Encoding</filter-name> 
                <filter-class>filters.SetCharacterEncodingFilter</filter-class> 
                <init-param> 
                        <param-name>encoding</param-name> 
                        <param-value>EUC_JP</param-value> 
                </init-param> 
        </filter> 
        <filter-mapping> 
                <filter-name>Set Character Encoding</filter-name> 
                <url-pattern>/*</url-pattern> 
        </filter-mapping> 

        <!-- Example filter to dump the HTTP request at the top of each page (from Tomcat servlets-examples context) --> 
        <filter> 
                <filter-name>Request Dumper Filter</filter-name> 
                <filter-class>filters.RequestDumperFilter</filter-class> 
        </filter> 
        <filter-mapping> 
                <filter-name>Request Dumper Filter</filter-name> 
                <url-pattern>/*</url-pattern> 
        </filter-mapping> 


        <!-- ========================================================== --> 
        <!-- Listeners --> 
        <!-- ========================================================== --> 

        <!-- Define example application events listeners --> 
        <listener> 
                <listener-class>com.metawerx.listener.ContextListener</listener-class> 
        </listener> 
        <listener> 
                <listener-class>com.metawerx.listener.SessionListener</listener-class> 
        </listener> 


        <!-- ========================================================== --> 
        <!-- Security --> 
        <!-- ========================================================== --> 

        <!-- Define roles --> 
        <security-role> 
                <role-name>admin</role-name> 
        </security-role> 
        <security-role> 
                <role-name>cms_editors</role-name> 
        </security-role> 
         
        <!-- Define a constraint to restrict access to /private/* --> 
        <security-constraint> 

                <display-name>Security constraint for the /private folder</display-name> 

                <web-resource-collection> 
                         
                        <web-resource-name>Protected Area</web-resource-name> 
                        <url-pattern>/private/*</url-pattern> 
                         
                        <!-- If you list http methods, only those methods are protected. --> 
                        <!-- Leave this commented out to protect all access --> 
                        <!-- 
                        <http-method>DELETE</http-method> 
                        <http-method>GET</http-method> 
                        <http-method>POST</http-method> 
                        <http-method>PUT</http-method> 
                        --> 

                </web-resource-collection> 

                <auth-constraint> 
                        <!-- Only only administrator and CMS editors to access this area --> 
                        <role-name>admin</role-name> 
                        <role-name>cms_editors</role-name> 
                </auth-constraint> 

        </security-constraint> 

        <!-- FORM based authentication --> 
        <!-- Leave this commented out, we will use BASIC (HTTP) authentication instead --> 
        <!-- 
        <login-config> 
                <auth-method>FORM</auth-method> 
                <form-login-config> 
                        <form-login-page>/login.jsp</form-login-page> 
                        <form-error-page>/error.jsp</form-error-page> 
                </form-login-config> 
        </login-config> 
        --> 
        <!-- This application uses BASIC authentication --> 
        <login-config> 
                <auth-method>BASIC</auth-method> 
                <realm-name>Editor Login</realm-name> 
        </login-config> 

        <!-- Define a constraint to force SSL on all pages in the application --> 
        <security-constraint> 

                <web-resource-collection> 
                        <web-resource-name>Entire Application</web-resource-name> 
                        <url-pattern>/*</url-pattern> 
                </web-resource-collection> 

                <user-data-constraint> 
                        <transport-guarantee>CONFIDENTIAL</transport-guarantee> 
                </user-data-constraint> 

        </security-constraint> 


        <!-- ========================================================== --> 
        <!-- Error Handler --> 
        <!-- ========================================================== --> 

        <!-- Define an error handler for 404 pages --> 
        <error-page> 
                <error-code>404</error-code> 
                <location>/error404.jsp</location> 
        </error-page> 

        <!-- Define an error handler for java.lang.Throwable --> 
        <error-page> 
                <exception-type>java.lang.Throwable</exception-type> 
                <location>/errorThrowable.jsp</location> 
        </error-page> 


        <!-- ========================================================== --> 
        <!-- Extra MIME types --> 
        <!-- ========================================================== --> 

        <!-- Set XML mime-mapping so spreadsheets open properly instead of being sent as an octet/stream --> 
        <mime-mapping> 
                <extension>xls</extension> 
                <mime-type>application/vnd.ms-excel</mime-type> 
        </mime-mapping> 


        <!-- ========================================================== --> 
        <!-- Locale --> 
        <!-- ========================================================== --> 

        <!-- Set Locale Encoding --> 
        <locale-encoding-mapping-list> 
                <locale-encoding-mapping> 
                        <locale>ja</locale> 
                        <encoding>Shift_JIS</encoding> 
                </locale-encoding-mapping> 
        </locale-encoding-mapping-list> 


        <!-- ========================================================== --> 
        <!-- Welcome Files --> 
        <!-- ========================================================== --> 

        <!-- Define, in order of preference, which file to show when no filename is defined in the path --> 
        <!-- eg: when user goes to http://yoursite.com/ or http://yoursite.com/somefolder --> 
        <!-- Defaults are provided in the server-wide web.xml file, such as index.jsp, index.htm --> 
        <!-- Note: using this tag overrides the defaults, so don‘t forget to add them here --> 
        <welcome-file-list> 
                <!-- Use index.swf if present, or splash.jsp, otherwise just look for the normal defaults --> 
                <welcome-file>index.swf</welcome-file> 
                <welcome-file>splash.jsp</welcome-file> 
                <welcome-file>index.html</welcome-file> 
                <welcome-file>index.htm</welcome-file> 
                <welcome-file>index.jsp</welcome-file> 
        </welcome-file-list> 

</web-app>

http://www.cnblogs.com/LittleHann/p/3725886.html
搜索：2. web.xml基础语法

1. <security-constraint>(fro html) -> <auth-constraint> ->  <role-name>  
2. 将"/html/*"(web-gui)的身份鉴权角色限制修改为一个自定义的角色名，例如"just4fun"，这个名字要保证tomcat的默认角色配置不会覆盖到，即达到对管理员的角色降权，禁止管理员
3. 针对web.xml的配置修改是立刻在tomcat中生效的，tomcat会对web.xml的修改自动做reload操作
4. manager页面会立刻禁止管理员登录

http://wiki.metawerx.net/wiki/Web.xml
http://fangyunfeng.iteye.com/blog/1862251

web.xml 的加载顺序是：context-param -> listener -> filter -> servlet ，而相同类型节点之间的程序调用的顺序是根据对应的mapping的顺序进行调用的

http://www.cnblogs.com/LittleHann/p/3725886.html
搜索：0x3: Filter介绍

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

/**
 * @author Administrator
 *
 */
public class LogFilter implements Filter {
    private FilterConfig filterConfig;

    public FilterConfig getFilterConfig() {
        System.err.println("...getFilterConfig...");
        return filterConfig;
    }

    public void setFilterConfig(FilterConfig filterConfig) {
        System.err.println("...setFilterConfig...");
        this.filterConfig = filterConfig;
    }

    /* (non-Javadoc)
     * @see javax.servlet.Filter#destroy()
     */
    @Override
    public void destroy() {
        System.err.println("...filter destroy...");
    }

    /* (non-Javadoc)
     * @see javax.servlet.Filter#doFilter(javax.servlet.ServletRequest, javax.servlet.ServletResponse, javax.servlet.FilterChain)
     */
    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException {
        System.err.println("...doFilter...");
        //传递下一个Filter
        chain.doFilter(request, response);
    }

    /* (non-Javadoc)
     * @see javax.servlet.Filter#init(javax.servlet.FilterConfig)
     */
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        System.err.println("...init Filter...");
        this.filterConfig = filterConfig;
    }

}

<filter>
    <filter-name>LogFilter</filter-name>
    <filter-class>com.ee.filter.LogFilter</filter-class>
</filter>

<filter-mapping>
    <filter-name>LogFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>