背景TongWeb7.0.4.9_M11增加出厂默认访问安全策略。默认仅本机可访问TongWeb控制台。只有修改控制台所有用户默认密码后才可开启远程访问。启动服务后访问控制台会提示通过命令行对开启控制台远程访问进行设置启动TW服务命令行需要访问9060端口进行操作首次使用“cli”用户时需要使用“change-admin-password”修改密码。默认密码cli123.com[rootlocalhost bin]# pwd /opt/TongWeb7.0.4.9_M11_Enterprise_Linux/bin [rootlocalhost bin]# [rootlocalhost bin]# ./commandstool.sh change-admin-password Please enter the admin user namecli Please enter the old admin passwordcli123.com Please enter the new admin passwordZxc124.com Please enter the new admin password againZxc124.com Command change-admin-password executed successfully. [rootlocalhost bin]#开启console远程访问注第一次必须修改四个用户的默认密码才能开启成功四个用户分别为系统管理员thanos、安全保密管理员security、安全审计员auditor、监视管理员monitor[rootlocalhost bin]# ./commandstool.sh update-console-remote-access --thanosPasswordZxc124.com --securityPasswordZxc124.com --auditorPasswordZxc124.com --monitorPasswordZxc124.com remotePlease enter the admin user namecli Please enter the admin passwordZxc124.com ************************ Console accesstypeissetto: remote Password update summary - updated users:[thanos, security, auditor, monitor], ignoredusers(already changed before):[none]. ************************ Command update-console-remote-access executed successfully.[rootlocalhost bin]#关闭console远程访问[rootlocalhost bin]# ./commandstool.sh update-console-remote-access localPlease enter the admin user namecli Please enter the admin passwordZxc124.com ************************ Console accesstypeissetto:local************************ Command update-console-remote-access executed successfully.[rootlocalhost bin]#开启heimdall远程访问注第一次必须修改四个用户的默认密码才能开启成功四个用户分别为系统管理员rig、安全保密管理员secadm、安全审计员audit、监视管理员monitor[rootlocalhost bin]# ./commandstool.sh update-heimdall-remote-access --rigPasswordZxc124.com --secadmPasswordZxc124.com --auditPasswordZxc124.com --monitorPasswordZxc124.com remotePlease enter the admin user namecli Please enter the admin passwordZxc124.com ************************ heimdall accesstypeissetto: remote Password update summary - updated users:[rig, secadm, audit, monitor], ignoredusers(already changed before):[none]. ************************ Command update-heimdall-remote-access executed successfully.[rootlocalhost bin]#关闭heimdall远程访问[rootlocalhost bin]# ./commandstool.sh update-heimdall-remote-access localPlease enter the admin user namecli Please enter the admin passwordZxc124.com ************************ heimdall accesstypeissetto:local************************ Command update-heimdall-remote-access executed successfully.[rootlocalhost bin]#cli用户的远程访问[rootlocalhost bin]# ./commandstool.sh update-cli-remote-access remotePlease enter the admin user namecli Please enter the admin passwordZxc124.com ************************ Cli accesstypeissetto:remote ************************ Command update-cli-remote-access executed successfully.[rootlocalhost bin]# ./commandstool.sh update-cli-remote-access localPlease enter the admin user namecli Please enter the admin passwordZxc124.com ************************ Cli accesstypeissetto:local************************ Command update-cli-remote-access executed successfully.[rootlocalhost bin]#修改后刷新页面注意地址是/console,不应该是/console/localerror.jsp,7. 生成的相关配置在conf/security/remote-access.properties 下动态密钥加密不可拷贝使用。如果忘记控制台密码通过删除twusers.properties.bak、heimdall-users.properties.bak文件并覆盖conf/security/下的twusers.properties、heimdall-users.properties 文件来恢复默认密码只要remote-access.properties文件保留重启后可以直接远程访问控制台。