Skip to content
ATO Pathways
  Log In

Apache Tomcat Application Server 9 Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-APP-000504-AS-000229

    <GroupDescription></GroupDescription>
    Group
    Show

  • Changes to $CATALINA_BASE/conf/ folder must be logged.

    &lt;VulnDiscussion&gt;The $CATALINA_BASE/conf folder contains configuration files for the Tomcat Catalina server. To provide forensic evidence in t...
    Rule Medium Severity
    Show

  • SRG-APP-000504-AS-000229

    <GroupDescription></GroupDescription>
    Group
    Show

  • Changes to $CATALINA_HOME/lib/ folder must be logged.

    &lt;VulnDiscussion&gt;The $CATALINA_HOME/lib folder contains library files for the Tomcat Catalina server. These are in the form of java archive (j...
    Rule Medium Severity
    Show

  • SRG-APP-000514-AS-000137

    <GroupDescription></GroupDescription>
    Group
    Show

  • Application servers must use NIST-approved or NSA-approved key management technology and processes.

    &lt;VulnDiscussion&gt;Class 3 PKI certificates are used for servers and software signing rather than for identifying individuals. Class 4 certifica...
    Rule Low Severity
    Show

  • SRG-APP-000516-AS-000237

    <GroupDescription></GroupDescription>
    Group
    Show

  • STRICT_SERVLET_COMPLIANCE must be set to true.

    &lt;VulnDiscussion&gt;Strict Servlet Compliance forces Tomcat to adhere to standards specifications including but not limited to RFC2109. RFC2109 s...
    Rule Low Severity
    Show

  • SRG-APP-000516-AS-000237

    <GroupDescription></GroupDescription>
    Group
    Show

  • RECYCLE_FACADES must be set to true.

    &lt;VulnDiscussion&gt;If RECYCLE_FACADES is true or if a security manager is in use, a new facade object will be created for each request. This red...
    Rule Low Severity
    Show

  • SRG-APP-000516-AS-000237

    <GroupDescription></GroupDescription>
    Group
    Show

  • ALLOW_BACKSLASH must be set to false.

    &lt;VulnDiscussion&gt;When Tomcat is installed behind a proxy configured to only allow access to certain Tomcat contexts (web applications), an HTT...
    Rule Medium Severity
    Show

  • SRG-APP-000516-AS-000237

    <GroupDescription></GroupDescription>
    Group
    Show

  • ENFORCE_ENCODING_IN_GET_WRITER must be set to true.

    &lt;VulnDiscussion&gt;Some clients try to guess the character encoding of text media when the mandated default of ISO-8859-1 should be used. Some b...
    Rule Medium Severity
    Show

  • SRG-APP-000516-AS-000237

    <GroupDescription></GroupDescription>
    Group
    Show

  • Tomcat users in a management role must be approved by the ISSO.

    &lt;VulnDiscussion&gt;Deploying applications to Tomcat requires a Tomcat user account that is in the "manager-script" role. Any user accounts in a ...
    Rule Medium Severity
    Show

  • SRG-APP-000516-AS-000237

    <GroupDescription></GroupDescription>
    Group
    Show

  • Hosted applications must be documented in the system security plan.

    &lt;VulnDiscussion&gt;The ISSM/ISSO must be cognizant of all applications operating on the Tomcat server, and must address any security implication...
    Rule Low Severity
    Show

  • SRG-APP-000516-AS-000237

    <GroupDescription></GroupDescription>
    Group
    Show

  • Connectors must be approved by the ISSO.

    &lt;VulnDiscussion&gt;Connectors are how Tomcat receives requests over a network port, passes them to hosted web applications via HTTP or AJP and t...
    Rule Low Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules