Deleting default user database resource from Tomcat's default server.xml configuration file

Viewed 1081

Tomcat's (8.0.27) server.xml file contains a default user database definition under global naming resources section:

  <GlobalNamingResources>
    <!-- Editable user database that can also be used by
         UserDatabaseRealm to authenticate users
    -->
    <Resource name="UserDatabase" auth="Container"
              type="org.apache.catalina.UserDatabase"
              description="User database that can be updated and saved"
              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
              pathname="conf/tomcat-users.xml" />
  </GlobalNamingResources>

Some scans discovered that tomcat-users.xml file contains plain text passwords. I am wondering whether this resource can be deleted? I am not planing to use this realm under my engine definition nor using the Tomcat manager application.

I didn't find any answer under Tomcat documentation section.

1 Answers
Related