You should be cautious when enabling the manager-jmx role.

One can do a lot, if one knows what commands to call. You need to define the appropriate roles (see the documentation for the full list), and add them to the user’s roles attribute, using a comma as the separator: Thanks for contributing an answer to Unix & Linux Stack Exchange! How to enable Apache Tomcat manager web application? How to add multiple roles in Apache Tomcat 8? To enable users to access the Tomcat manager page, add a user as the role manager-gui. xml, by default, there is NO user, it means no one can access the Tomcat manager page. Tomcat users are defined in the file – $TOMCAT_HOME/conf/tomcat-users. Tomcat configuration files are found in the directory: CATALINA_HOME/conf (where CATALINA_HOME environment variable is the Tomcat installation directory). In Tomcat 7, under TOMCAT_HOME/conf/tomcat_users. To change the Apache Tomcat Administration Console password, perform the following: Edit the /apache-tomcat-/conf/tomcat-users. How do I change my Tomcat 8 username and password? Which file is used to configure users in Tomcat? – To use this “user” just restart your TOMCAT WEB SERVER and NETBEANS.This will modify your “tomcat-users.xml” and will add: user password=”MYPASS” roles=”manager-script,admin,tomcat” username=”MYUSER” How do I change my Tomcat username and password in Netbeans? The default path to load the Tomcat Manager application is You will be prompted to enter the username and password that was stored in tomcat-users. manager-script - Access to the tools-friendly plain text interface that is described in this document, and to the “Server Status” page.manager-status - Access to the “Server Status” page only.manager-gui - Access to the HTML interface.

Apache tomcat 8 username password