TCAT-AS-000580 – Documentation must be removed.
Details Tomcat provides documentation and other directories in the default installation which do not serve a production use. These files...
- Home
- Security Hardening
- DISA STIG Apache Tomcat Application Server 9 V2R3 Middleware
DISA STIG Apache Tomcat Application Server 9 V2R3 Middleware
TCAT-AS-000590 – Applications in privileged mode must be approved by the ISSO.
Details The privileged attribute controls if a context (application) is allowed to use container provided servlets like the Manager servlet....TCAT-AS-000600 – Tomcat management applications must use LDAP realm authentication.
Details Using the local user store on a Tomcat installation does not meet a multitude of security control requirements related...TCAT-AS-000610 – JMX authentication must be secured.
Details Java Management Extensions (JMX) provides the means to remotely manage the Java VM. When enabling the JMX agent for...TCAT-AS-000630 – TLS must be enabled on JMX.
Details Java Management Extensions (JMX) provides the means for enterprises to remotely manage the Java VM and can be used...TCAT-AS-000530 – The deployXML attribute must be set to false in hosted environments.
Details The Host element controls deployment. Automatic deployment allows for simpler management, but also makes it easier for an attacker...TCAT-AS-000540 – Autodeploy must be disabled.
Details Tomcat allows auto-deployment of applications while Tomcat is running. This can allow untested or malicious applications to be automatically...TCAT-AS-000550 – xpoweredBy attribute must be disabled.
Details Individual connectors can be configured to display the Tomcat server info to clients. This information can be used to...TCAT-AS-000690 – LDAP authentication must be secured.
Details JNDIRealm is an implementation of the Tomcat Realm interface. Tomcat uses the JNDIRealm to look up users in an...TCAT-AS-000700 – DoD root CA certificates must be installed in Tomcat trust store.
Details Tomcat truststores are used to validate client certificates. On the Ubuntu OS, by default Tomcat uses the ‘cacerts’ file...