Page History

...

• Use properties replacement so that in the xml config you have ${db.password} and in conf/catalina.properties you put the password there.
• Since server.xml is an XML file — you can use XML entities. For example: "woot" becomes "woot" which is a way to obscure the password. You may even go through an extra layer of indirection by converting ${db.password} into XML entities so that the property replacement above is also performed. (But remember, while "clever, not more secure)
• XML entities can be read from an external file. That is, add the following lines text at the top of server.xml just above after the XML declaration (<?xml ...?>) and before the <Server> element (line wraps can be removed):
  

<!DOCTYPE server-xmlServer [
  <!ENTITY resources SYSTEM "resources.txt">
]>

...