Protect folders outside webapps

[Mary Cole]

Hi,

I have defined a context.xml so that the user can browse the files under that dir...for example

 <Context path="/logs" docBase="/usr/local/sample/log" />
   

so that it can be access through browser like http://localhost:8080/logs. Right now anybody can see this logs, but I want to protect it...Please guide me how to do?

Thanks

[Mary Cole]

Any suggestions guyz

[John Peters]

Mary,
I'm not familiar with context.xml files, but I googled around for a minute and found two articles on it:

Link 1

Link 2

It looks like you need to define a realm in the context.xml file (Link 1):

    <!-- Specify the security realm and location of the users file -->
    <Realm className="org.apache.catalina.realm.MemoryRealm" 
           pathname="/tomcat/webapps/ROOT/WEB-INF/users.xml" />

And then set up your web.xml file to secure that specific directory with some sort of container based authentication (Link 2).

If you're using Apache as the proxy between Tomcat, you can insert a Deny statement in a <directory> for that directory in the httpd.conf file
Authentication, Authorization, and Access Control in Apache Web Server