TCAT-AS-000010 – The number of allowed simultaneous sessions to the manager application must be limited.
Details The manager application provides configuration access to the Tomcat server. Access to the manager application must be limited and...
- Home
- Security Hardening
- DISA STIG Apache Tomcat Application Server 9 V2R3
DISA STIG Apache Tomcat Application Server 9 V2R3
TCAT-AS-000020 – Secured connectors must be configured to use strong encryption ciphers.
Details The Tomcat element controls the TLS protocol and the associated ciphers used. If a strong cipher is not selected,...TCAT-AS-000030 – HTTP Strict Transport Security (HSTS) must be enabled.
Details HTTP Strict Transport Security (HSTS) instructs web browsers to only use secure connections for all future requests when communicating...TCAT-AS-000040 – TLS 1.2 must be used on secured HTTP connectors.
Details Using older versions of TLS introduces security vulnerabilities that exist in the older versions of the protocol. Tomcat by...TCAT-AS-000050 – AccessLogValve must be configured for each application context.
Details Tomcat has the ability to host multiple contexts (applications) on one physical server by using the attribute. This allows...TCAT-AS-000060 – Default password for keystore must be changed.
Details Tomcat currently operates only on JKS, PKCS11, or PKCS12 format keystores. The JKS format is Java’s standard ‘Java KeyStore’...TCAT-AS-000070 – Cookies must have secure flag set.
Details It is possible to steal or manipulate web application session and cookies without having a secure cookie. Configuring the...TCAT-AS-000080 – Cookies must have http-only flag set.
Details It is possible to steal or manipulate web application session and cookies without having a secure cookie. Configuring the...TCAT-AS-000090 – DefaultServlet must be set to readonly for PUT and DELETE.
Details The DefaultServlet is a servlet provided with Tomcat. It is called when no other suitable page can be displayed...TCAT-AS-000260 – HTTP status code must be logged.
Details The access logfile format is defined within a Valve that implements the org.apache.catalina.valves.AccessLogValve interface within the /opt/tomcat/server.xml configuration file:...