Details

Application servers utilize role-based access controls in order to specify the individuals who are allowed to configure application component loggable events. The application server must be configured to select which personnel are assigned the role of selecting which loggable events are to be logged.

Satisfies: SRG-APP-000090-AS-000051, SRG-APP-000095-AS-000056, SRG-APP-000100-AS-000063, SRG-APP-000101-AS-000072, SRG-APP-000503-AS-000228, SRG-APP-000505-AS-000230, SRG-APP-000506-AS-000231

Solution

As a privileged user on the Tomcat server:

Edit the $CATALINA_BASE/conf/server.xml file.

Create a element that is nested beneath the element containing an AccessLogValve.

EXAMPLE:
unpackWARs=’true’ autoDeploy=’false’>
…
prefix=’localhost_access_log’ suffix=’.txt’
pattern=’%h %l %t %u "%r" %s %b’ />
…

Restart the Tomcat server:
sudo systemctl restart tomcat
sudo systemctl daemon-reload

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apache_Tomcat_Application_Server_9_V2R3_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Audit and Accountability.This control applies to the following type of system Unix.

References

• 800-53|AU-3
• 800-53|AU-3(1)
• 800-53|AU-12b.
• 800-53|AU-12c.
• CAT|II
• CCI|CCI-000130
• CCI|CCI-000135
• CCI|CCI-000171
• CCI|CCI-000172
• CCI|CCI-001487
• Rule-ID|SV-222938r615938_rule
• STIG-ID|TCAT-AS-000180
• STIG-Legacy|SV-111549
• STIG-Legacy|V-102603
• Vuln-ID|V-222938

Source

• Tenable.com/audits