title: Tomcat 9 JMX RMI authentication vulnerability
body: <p>I am pretty new to Java and Tomcat but we have no one else that has any clue on either one so I get to try and remedy the issue.</p>
  <p>We are recently upgrading from Tomcat 8 to Tomcat 9.  I am trying to enable authentication due to a Qualys open vulnerability of JMX RMI accessible with common credentials.  I have the following settings defined in the Java Options:</p>
  <pre><code>-Dcom.sun.management.jmxremote.port=8080
  -Dcom.sun.management.jmxremote.authenticate=true
  -Dcom.sun.management.jmxremote.ssl=false
  -Dcom.sun.management.jmxremote.password.file=C:\Program Files\Java\jre1.8.0_291\lib\management\jmxremote.password
  -Dcom.sun.management.jmxremote.access.file=C:\Program Files\Java\jre1.8.0_291\lib\management\jmxremote.access
  </code></pre>
  <p>I currently have both Tomcat 8 and Tomcat 9 installed.  They are both using the same Java Options.  However, when I start the Tomcat 9 service, I get a error 1067 about the process terminating unexpectedly.</p>
  <p>Tomcat 8 with the same setting starts and runs fine.  If I set the option to authenticate to false, Tomcat 9 has no problems starting and running.  Is there any additional Java Options that I need to add with Tomcat 9 that I did not need with Tomcat 8?</p>
  <p>This is only needed to close the Qualys vulnerability.  The server does not actually need to connect using JMX remotely.</p>