Skip to content
ATO Pathways
  Log In

Apache Tomcat Application Server 9 Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-APP-000267-AS-000170

    <GroupDescription></GroupDescription>
    Group
    Show

  • Default error pages for manager application must be customized.

    &lt;VulnDiscussion&gt;Default error pages that accompany the manager application provide educational information on how to configure user accounts ...
    Rule Low Severity
    Show

  • SRG-APP-000267-AS-000170

    <GroupDescription></GroupDescription>
    Group
    Show

  • ErrorReportValve showReport must be set to false.

    &lt;VulnDiscussion&gt;The Error Report Valve is a simple error handler for HTTP status codes that will generate and return HTML error pages. It can...
    Rule Medium Severity
    Show

  • SRG-APP-000295-AS-000263

    <GroupDescription></GroupDescription>
    Group
    Show

  • Idle timeout for the management application must be set to 10 minutes.

    &lt;VulnDiscussion&gt;Tomcat can set idle session timeouts on a per application basis. The management application is provided with the Tomcat insta...
    Rule Medium Severity
    Show

  • SRG-APP-000315-AS-000094

    <GroupDescription></GroupDescription>
    Group
    Show

  • LockOutRealms failureCount attribute must be set to 5 failed logins for admin users.

    &lt;VulnDiscussion&gt;A LockOutRealm adds the ability to lock a user out after multiple failed logins. Setting the failureCount attribute to 5 will...
    Rule Medium Severity
    Show

  • SRG-APP-000316-AS-000199

    <GroupDescription></GroupDescription>
    Group
    Show

  • LockOutRealms lockOutTime attribute must be set to 600 seconds (10 minutes) for admin users.

    &lt;VulnDiscussion&gt;A LockOutRealm adds the ability to specify a lockout time that prevents further attempts after multiple failed logins. Settin...
    Rule Low Severity
    Show

  • SRG-APP-000340-AS-000185

    <GroupDescription></GroupDescription>
    Group
    Show

  • Tomcat user account must be set to nologin.

    &lt;VulnDiscussion&gt;When installing Tomcat, a user account is created on the OS. This account is used in order for Tomcat to be able to operate o...
    Rule Medium Severity
    Show

  • SRG-APP-000340-AS-000185

    <GroupDescription></GroupDescription>
    Group
    Show

  • Tomcat user account must be a non-privileged user.

    &lt;VulnDiscussion&gt;Use a distinct non-privileged user account for running Tomcat. If Tomcat processes are compromised and a privileged user acco...
    Rule Medium Severity
    Show

  • SRG-APP-000343-AS-000030

    <GroupDescription></GroupDescription>
    Group
    Show

  • Application user name must be logged.

    &lt;VulnDiscussion&gt;The access logfile format is defined within a Valve that implements the org.apache.catalina.valves.AccessLogValve interface w...
    Rule Low Severity
    Show

  • SRG-APP-000380-AS-000088

    <GroupDescription></GroupDescription>
    Group
    Show

  • $CATALINA_HOME folder must be owned by the root user, group tomcat.

    &lt;VulnDiscussion&gt;Tomcat file permissions must be restricted. The standard configuration is to have the folder where Tomcat is installed owned ...
    Rule Medium Severity
    Show

  • SRG-APP-000380-AS-000088

    <GroupDescription></GroupDescription>
    Group
    Show

  • $CATALINA_BASE/conf/ folder must be owned by root, group tomcat.

    &lt;VulnDiscussion&gt;Tomcat file permissions must be restricted. The standard configuration is to have Tomcat files contained in the conf/ folder ...
    Rule Medium Severity
    Show

  • SRG-APP-000380-AS-000088

    <GroupDescription></GroupDescription>
    Group
    Show

  • $CATALINA_BASE/logs/ folder must be owned by tomcat user, group tomcat.

    &lt;VulnDiscussion&gt;Tomcat file permissions must be restricted. The standard configuration is to have all Tomcat files owned by root with group T...
    Rule Medium Severity
    Show

  • SRG-APP-000380-AS-000088

    <GroupDescription></GroupDescription>
    Group
    Show

  • $CATALINA_BASE/temp/ folder must be owned by tomcat user, group tomcat.

    &lt;VulnDiscussion&gt;Tomcat file permissions must be restricted. The standard configuration is to have all Tomcat files owned by root with group T...
    Rule Low Severity
    Show

  • SRG-APP-000380-AS-000088

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-APP-000516-AS-000237

    <GroupDescription></GroupDescription>
    Group
    Show

  • $CATALINA_BASE/temp folder permissions must be set to 750.

    &lt;VulnDiscussion&gt;Tomcat's file permissions must be restricted. The standard configuration is to have all Tomcat files owned by root with the g...
    Rule Low Severity
    Show

  • SRG-APP-000380-AS-000088

    <GroupDescription></GroupDescription>
    Group
    Show

  • $CATALINA_BASE/work/ folder must be owned by tomcat user, group tomcat.

    &lt;VulnDiscussion&gt;Tomcat file permissions must be restricted. The standard configuration is to have all Tomcat files owned by root with group T...
    Rule Medium Severity
    Show

  • SRG-APP-000391-AS-000239

    <GroupDescription></GroupDescription>
    Group
    Show

  • Multifactor certificate-based tokens (CAC) must be used when accessing the management interface.

    &lt;VulnDiscussion&gt;Password authentication does not provide sufficient security control when accessing a management interface. DOD has specified...
    Rule Medium Severity
    Show

  • SRG-APP-000427-AS-000264

    <GroupDescription></GroupDescription>
    Group
    Show

  • Certificates in the trust store must be issued/signed by an approved CA.

    &lt;VulnDiscussion&gt;Use of self-signed certificates creates a lack of integrity and invalidates the certificate based authentication trust model....
    Rule Medium Severity
    Show

  • SRG-APP-000435-AS-000069

    <GroupDescription></GroupDescription>
    Group
    Show

  • The application server, when categorized as a high availability system within RMF, must be in a high-availability (HA) cluster.

    &lt;VulnDiscussion&gt;A MAC I system is a system that handles data vital to the organization's operational readiness or effectiveness of deployed o...
    Rule Medium Severity
    Show

  • SRG-APP-000435-AS-000163

    <GroupDescription></GroupDescription>
    Group
    Show

  • Tomcat server must be patched for security vulnerabilities.

    &lt;VulnDiscussion&gt;Tomcat is constantly being updated to address newly discovered vulnerabilities, some of which include denial-of-service attac...
    Rule Medium Severity
    Show

  • SRG-APP-000495-AS-000220

    <GroupDescription></GroupDescription>
    Group
    Show

  • AccessLogValve must be configured for Catalina engine.

    &lt;VulnDiscussion&gt;The &lt;Engine&gt; container represents the entire request processing machinery associated with a particular Catalina Service...
    Rule Medium Severity
    Show

  • SRG-APP-000504-AS-000229

    <GroupDescription></GroupDescription>
    Group
    Show

  • Changes to $CATALINA_HOME/bin/ folder must be logged.

    &lt;VulnDiscussion&gt;The $CATALINA_HOME/bin folder contains startup and control scripts for the Tomcat Catalina server. To provide forensic eviden...
    Rule Medium Severity
    Show

  • SRG-APP-000504-AS-000229

    <GroupDescription></GroupDescription>
    Group
    Show

  • Changes to $CATALINA_BASE/conf/ folder must be logged.

    &lt;VulnDiscussion&gt;The $CATALINA_BASE/conf folder contains configuration files for the Tomcat Catalina server. To provide forensic evidence in t...
    Rule Medium Severity
    Show

  • SRG-APP-000504-AS-000229

    <GroupDescription></GroupDescription>
    Group
    Show

  • Changes to $CATALINA_HOME/lib/ folder must be logged.

    &lt;VulnDiscussion&gt;The $CATALINA_HOME/lib folder contains library files for the Tomcat Catalina server. These are in the form of java archive (j...
    Rule Medium Severity
    Show

  • SRG-APP-000514-AS-000137

    <GroupDescription></GroupDescription>
    Group
    Show

  • Application servers must use NIST-approved or NSA-approved key management technology and processes.

    &lt;VulnDiscussion&gt;Class 3 PKI certificates are used for servers and software signing rather than for identifying individuals. Class 4 certifica...
    Rule Low Severity
    Show

  • SRG-APP-000516-AS-000237

    <GroupDescription></GroupDescription>
    Group
    Show

  • STRICT_SERVLET_COMPLIANCE must be set to true.

    &lt;VulnDiscussion&gt;Strict Servlet Compliance forces Tomcat to adhere to standards specifications including but not limited to RFC2109. RFC2109 s...
    Rule Low Severity
    Show

  • SRG-APP-000516-AS-000237

    <GroupDescription></GroupDescription>
    Group
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules