closing the tomcat shutdown port 8005?

Daniel G._ikllim

In my config files of dockerised Jira and Confluence, I have found "SHUTDOWN_PORT=8005" (along with standard 8080). I was wondering, what actuall consequences would I have if I close this port or simply do not expose it?
Would it have some consequences on the overall stability of the pod during running or shutting down?

Andy Heinzer

The shutdown port is expected to be open, but only really needs to be accessible from the machine running Tomcat.  It does not need to be accessible to outside addresses in most cases.   If you close it off entirely, you can do that by not listing any port number at all, then the shutdown scripts used to try to shutdown the instance are likely to be unable to cleanly stop the process.  Depending on what is happening in the process at that time, it is possible that you could have some kind of data loss, or index corruption, etc during shutdown.

I think the better solution would be to only expose that port to the localhost / loopback address.  That way the server running jira can still shutdown cleanly, but you won't get shutdown attempts from other interfaces. 

I also found this site that offers some other ideas about securing the shutdown port, check out https://www.owasp.org/index.php/Securing_tomcat#Protecting_the_Shutdown_Port as it might be of interest here.