Tomcat password encryption steps

For each of the standard Realm implementations, the user’s password (by default) is stored in clear text. In many environments, this is undesirable because casual observers of the authentication data can collect enough information to log on successfully, and impersonate other users. To avoid this problem, the standard implementations support the concept of digesting user passwords. This allows the stored version of the passwords to be encoded (in a form that is not easily reversible), but that the Realm implementation can still utilize for authentication.

When a standard realm authenticates by retrieving the stored password and comparing it with the value presented by the user, you can select digested passwords by specifying the digest attribute on your <Realm> element. The value for this attribute must be one of the digest algorithms supported by the java.security.MessageDigest class (SHA, MD2, or MD5). When you select this option, the contents of the password that is stored in the Realm must be the cleartext version of the password, as digested by the specified algorithm.

When the authenticate() method of the Realm is called, the (clear text) password specified by the user is itself digested by the same algorithm, and the result is compared with the value returned by the Realm. An equal match implies that the cleartext version of the original password is the same as the one presented by the user, so that this user should be authorized.

Let’s discuss each step briefly and enforce the password encryption policy for the Tomcat Manager.

Here we will discuss about using SHA-256 and MD5 hash algorithms to encrypt the tomcat manager password in Tomcat 8.5.6 and Tomcat 6/7

Step 1. We have to define the password encryption algorithm in the Realm section of server.xml, as in the following line of code:

For Tomcat 8:

SHA-256:

<!-- Use the LockOutRealm to prevent attempts to guess user passwords via a brute-force attack -->

<Realm className="org.apache.catalina.realm.LockOutRealm">
<Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase">
<CredentialHandler className="org.apache.catalina.realm.MessageDigestCredentialHandler" algorithm="SHA-256" />
</Realm>
</Realm>

MD5:

If you want to use any other algorithms like MD5 then just replace the algorithm section with MD5 like below keeping everything else same.

<Realm className="org.apache.catalina.realm.LockOutRealm">
<Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase">
<CredentialHandler className="org.apache.catalina.realm.MessageDigestCredentialHandler" algorithm="MD5" />
</Realm>
</Realm>

For Tomcat 6/7:

In older version tomcat like the version tomcat 7 you can use below way to add your algorithm.

<Realm className= "org.apache.catalina.realm.MemoryRealm"digest="MD5" />

Step 2. Now go to tomcat_home/bin and run the following command, it will generate the encrypted algorithm, as shown in the following screenshot:

For Tomcat 8:

SHA-256:

D:\Programs\apache-tomcat-8.5.6\apache-tomcat-8.5.6\bin>digest.bat
Usage: RealmBase [-a <algorithm>] [-e <encoding>] [-i <iterations>] [-s <salt-length>] [-k <key-length>] [-h <handler-class-name>] <credentials>
D:\Programs\apache-tomcat-8.5.6\apache-tomcat-8.5.6\bin>digest.bat -a SHA-256 -h org.apache.catalina.realm.MessageDigestCredentialHandler mysecret_password
mysecret_password:371c8e07f4d7c0ae8b352e675ad67ee3c4e44154a50be700e42c66ed3741c3f4$1$e0f79e487e8c443aff9777d825ffd95d8d29e5b1c45b7a041b3c37ecb1418faa

MD5:

D:\Programs\apache-tomcat-8.5.6\apache-tomcat-8.5.6\bin>digest.bat -a MD5 -h org.apache.catalina.realm.MessageDigestCredentialHandler mysecret_password
mysecret_password:da1a3f77b3a85fec4526096c2d26d50c4c9a62111c6eb4fc4492d59b319ef9d0$1$81ac256f4c7b588e9bae66f64a1a5e33

Note:

1. Only Copy the encrypted password in bold to use in tomcat-users.xml file.
2. It is very important to use the -h org.apache.catalina.realm.MessageDigestCredentialHandler tag while generating the password else it will not work.

For Tomcat 6/7:

[root@localhost bin]# ./digest.sh -a MD5 secret

The previous command can be described as ./digest.sh = script, which generates the password for Tomcat realm and -a = algorithm used, currently we are using MD5 algorithm for tomcat 6/7.

Step 3. Copy the SHA-256 or MD5 string and replace the password text from tomcat_user.xml with the following line of code:

For Tomcat 8:

SHA-256:

<role rolename="manager-gui"/>
<role rolename="manager"/>
<role rolename="admin"/>
<user username="admin" password="371c8e07f4d7c0ae8b352e675ad67ee3c4e44154a50be700e42c66ed3741c3f4$1$e0f79e487e8c443aff9777d825ffd95d8d29e5b1c45b7a041b3c37ecb1418faa" roles="manager-gui,manager,admin"></user>

MD5:

<role rolename="manager-gui"/>
<role rolename="manager"/>
<role rolename="admin"/>
<user username="admin" password="da1a3f77b3a85fec4526096c2d26d50c4c9a62111c6eb4fc4492d59b319ef9d0$1$81ac256f4c7b588e9bae66f64a1a5e33" roles="manager-gui,manager,admin"></user>
</tomcat-users>

For Tomcat 6/7:

<user name="admin" password="5ebe2294ecd0e0f08eab7690d2a6ee69 " roles="manager-gui" />

Step 4. Reload/restart the Tomcat services and log in to the Tomcat Manager using the password.

If you have followed exactly whats written in this article then for Tomcat 8 the username will be admin and password is mysecret_password and for Tomcat 6/7 user name will be admin and password will be secret.

Access http://hostname:8080/manager/

login using the plain passwords:

If you want more info on other tomcat realm’s then you may visit the official tomcat site for more info.

If any one still having issues with encryption to work I have uploaded the tested tomcat zip with all settings for SHA-256 here for download and use.

Tomcat manager username password: admin/admin

Make sure JDK version is as below to replicate the exact testing scenario(JDK can be downloaded from Oracle Java archive here):

D:\Programs\apache-tomcat-8.5.6\apache-tomcat-8.5.6\bin>java -version
java version "1.7.0_25"
Java(TM) SE Runtime Environment (build 1.7.0_25-b17)
Java HotSpot(TM) 64-Bit Server VM (build 23.25-b01, mixed mode)

My CLASSPATH and PATH was set to below:

D:\Programs\apache-tomcat-8.5.6\apache-tomcat-8.5.6\bin>echo %PATH%
D:\Programs\Java\jdk1.7.0_25/bin;F:\Oracle12c\product\12.1.0\dbhome_1\bin;C:\Program Files (x86)\Intel\iCLS Client\;C:\Program Files\Intel\iCLS Client\

D:\Programs\apache-tomcat-8.5.6\apache-tomcat-8.5.6\bin>echo %CLASSPATH%
.;D:\Programs\Java\jdk1.7.0_25\lib\tools.jar;D:\Programs\Java\jdk1.7.0_25\jre\lib\rt.jar

How to setup the pre-packaged tomcat with SHA-256 encryption:

1. Download the JDK 1.7.0_25 from Oracle Java archive here.
2. Install the same and set the PATH and CLASSPATH like below. Example for windows:

open command prompt in administrator mode or normal user mode

set PATH=D:\Programs\Java\jdk1.7.0_25\bin;%PATH%

set CLASSPATH=.;D:\Programs\Java\jdk1.7.0_25\lib\tools.jar;D:\Programs\Java\jdk1.7.0_25\jre\lib\rt.jar

cd to <Tomcat extract dir>/bin

use startup.bat to start the tomcat.

Access http://localhost:8081/manager/ URL

when prompted for password use admin/admin as username and password

you shall be able to login now.

Example start Output from my screen:
D:\Programs\apache-tomcat-8.5.6\apache-tomcat-8.5.6\bin>cd D:\Programs\apache-tomcat-8.5.6\apache-tomcat-8.5.6\bin

D:\Programs\apache-tomcat-8.5.6\apache-tomcat-8.5.6\bin>startup.bat
Using CATALINA_BASE: "D:\Programs\apache-tomcat-8.5.6\apache-tomcat-8.5.6"
Using CATALINA_HOME: "D:\Programs\apache-tomcat-8.5.6\apache-tomcat-8.5.6"
Using CATALINA_TMPDIR: "D:\Programs\apache-tomcat-8.5.6\apache-tomcat-8.5.6\temp"
Using JRE_HOME: "D:\Programs\Java\jdk1.7.0_25"
Using CLASSPATH: "D:\Programs\apache-tomcat-8.5.6\apache-tomcat-8.5.6\bin\bootstrap.jar;D:\Programs\apache-tomcat-8.5.6\apache-tomcat-8.5.6\bin\tomcat-juli.jar"

In case of any ©Copyright or missing credits issue please check CopyRights page for faster resolutions.