Security risks in Tomcat Manager externally accessible

Question

I'm planning to make the Tomcat (8.5) Manager accessible through a subdomain like this: https://tomcat.mydomain.com.

As you can see the connection is over HTTPS, but still, does this pose a security risk and is considered as 'bad practice'?

One think I did notice is that, by looking at the certificate for mydomain.com, you can see that https://tomcat.mydomain.com does exists. Which means there is not much security by obscurity.

Of course, it's important to have the tomcat accounts setup right and protected by a password, which I have.

Answer 1

Having the endpoint publicly accessible is not, in itself, a security risk. There are other considerations, though, that you might want to take into account when deciding whether or not to expose an administrative interface publicly:

1. How many people have credentials for the service?
2. Can all those people be trusted to have good passwords?
3. Can all those people be trusted not to re-use passwords across multiple sites?
4. Do you have lock-outs enabled (on by default if using Tomcat's authentication with the Manager app)?
5. Can the lock-outs be overwhelmed? (consider the lock-out implementation)
6. Do admins actually need public access to the Manager?
7. Are there additional layers of security you could add between the public and the management interface?

In general, I usually choose not to expose administrative interfaces to the public. I almost always require an administrative user to go through some other gate such as an ssh tunnel (with public-key-only access) before they can access any management interface, and then they most also authenticate a second time through that interface (i.e. you aren't automatically trusted just because you have the tunnel established).

If I were going to expose an administrative interface to the public, I think I would want something in addition to password-based authentication in the mix. Some other factor should be involved, whether that is something like a common 2FA solution like TOTP or similar, or TLS client certificates ("mutual authentication").

There is a presentation on the Tomcat web site about upgrading your credential security. There is sample code and configuration in there for how to set up TOTP within Tomcat's existing authentication system. You might want to read that presentation and consider whether you want to add protection like that to your administrative interfaces.