These applications have been known to harbor vulnerabilities, and should be removed if not in use. Most web server platforms also provide a set of sample or test web application for demo and learning purposes. Remove Any Default Sample or Test Web Applications In Tomcat's case, a user with the minimum necessary OS permissions should be created exclusively to run the Tomcat process. Web-related services should not be run by user accounts with a high level of administrative access. This line of advice applies to most web server platforms. The following are 15 way to secure Apache Tomcat 8, out-of-the-box. Currently at version 8, the popular web server has not been without its security flaws, perhaps most famously publicized in this incident of aircraft hacking by security researcher Chris Roberts earlier this year. However, hardening Tomcat's default configuration is just plain good security sense-even if you don't plan on using it on your plane's network. Apache Tomcat is the leading Java application server by market share and the world's most widely used web application server overall.

Apache tomcat 8 free download