Cron reload wepapp Tomcat

maro55 · 09-27-2015, 01:45 AM

hi

how i used curl for reload single application tomcat?

1)i add user of the script only

Code:

<role rolename="manager-gui"/>
<user username="admin" password="pwdadmin" roles="manager-gui"/>
 
<role rolename="manager-script"/>
<user username="script" password="pwdscript" roles="manager-script"/>
 
</tomcat-users>

2)

Code:

30 6 * * * curl --user script:pwdscript http://@ip:8181/manager/html/reload?path=/name_application

but it not working

when i reload form borwser and with user admin the url is like this:

Code:

http://@ip:8181/manager/html/reload?path=/name_application&&org.apache.catalina.filters.CSRF_NONCE=.....

thanks

(tomcat8 ,centos6)

bonnydeal · 09-27-2015, 09:08 AM

There are probably 2 things wrong here:

1. Tomcat manager uses a cookie to store a session, so you need to use 2 curl commands with a cookie jar - one to login and get the session cookie and one to do the reload (using the cookie you got in the first call).
2. You should use the exact same url in your curl as is used in the browser.

maro55 · 09-27-2015, 02:39 PM

hi,

thanks... so the

Code:

http://@ip:8181/manager/html/reload?path=/name_application&org.apache.catalina.filters.CSRF_NONCE=ID_Session

???!

Code:

30 6 * * * curl --user script:pwdscript --cookie-jar ./idmanager.txt http://@ip:8181/manager
30 6 * * * curl --cookie ./idmanager.txt http://@ip:8181/manager/html/reload?path=/name_application&org.apache.catalina.filters.CSRF_NONCE=....

it is fine like that ? the save of id session?
what i but after org.apache.catalina.filters.CSRF_NONCE?!

bonnydeal · 09-27-2015, 03:01 PM

yes, but you need to do the 2 curl commands in sequence, either one of the cron jobs could fire first. If the reload fires first - it wont have the session cookie, or it will be an old one if the file still hanging around.
So i would put them in a shell script and call that from the crontab file.

Code:

#!/bin/bash
curl --user script:pwdscript --cookie-jar ./idmanager.txt  http://@ip:8181/manager/html
curl --user script:pwdscript --cookie-jar ./idmanager.txt  http://@ip:8181/manager/html/reload?path=/name_application

I think you can leave off the '&org.apache...'

maro55 · 09-28-2015, 01:04 AM

Hi,

Exemple script shell
With vi :

Code:

#!/bin/bash
clear
echo "Good morning, world."

chmod 755 morning
and i run it :

Code:

./morning

==> it works
So,i have edit the script with

Code:

#!/bin/bash
curl --user script:pwdscript --cookie-jar ./idmanager.txt  http://@ip:8181/manager/html
curl --user script:pwdscript --cookie-jar ./idmanager.txt  http://@ip:8181/manager/html/reload?path=/name_application

then with crontab -e

Code:

30 6 * * * ./morning

it is fine like this?!

bonnydeal · 09-28-2015, 02:38 PM

Should be.

There's also nothing stopping you running the script from the command line and viewing the output, and checking tomcat ...

maro55 · 09-29-2015, 12:23 AM

thanks,

I have to empty the contents of this file idmanager.txt to have the right prefermence?
or to secure my server?

bonnydeal · 09-29-2015, 03:53 AM

Yes.
You can delete it at the end of the shell script.

maro55 · 09-30-2015, 12:42 AM

hi,
when i run the shell

Code:

./morning

they retrun html reponse

Code:

 <body>
   <h1>403 Access Denied</h1>
   <p>
    You are not authorized to view this page.
   </p>
   <p>
    If you have already configured the Manager application to allow access and
    you have used your browsers back button, used a saved book-mark or similar
    then you may have triggered the cross-site request forgery (CSRF) protection
    that has been enabled for the HTML interface of the Manager application. You
    will need to reset this protection by returning to the
    <a href="/manager/html">main Manager page</a>. Once you
    return to this page, you will be able to continue using the Manager
    appliction's HTML interface normally. If you continue to see this access
    denied message, check that you have the necessary permissions to access this
    application.
   </p>

bonnydeal · 09-30-2015, 04:54 AM

It says CSRF protection has been triggered.
So you need the complete url -
http://@ip:8181/manager/html/reload?...rs.CSRF_NONCE=....

You will have to look at the network traffic when yopu successfully complete the operation in the browser to see what to use for the id.
You can use developer tools in chrome or firebug in firefox to look at what gets sent back and forth to tomcat server.