Tomcat's (8.0.27) server.xml file contains a default user database definition under global naming resources section:
<GlobalNamingResources>
<!-- Editable user database that can also be used by
UserDatabaseRealm to authenticate users
-->
<Resource name="UserDatabase" auth="Container"
type="org.apache.catalina.UserDatabase"
description="User database that can be updated and saved"
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
pathname="conf/tomcat-users.xml" />
</GlobalNamingResources>
Some scans discovered that tomcat-users.xml file contains plain text passwords. I am wondering whether this resource can be deleted? I am not planing to use this realm under my engine definition nor using the Tomcat manager application.
I didn't find any answer under Tomcat documentation section.