TCAT-AS-000560 – Example applications must be removed.
Details Tomcat provides example applications, documentation, and other directories in the default installation which do not serve a production use....
- Home
- Security Hardening
- DISA STIG Apache Tomcat Application Server 9 V2R3
DISA STIG Apache Tomcat Application Server 9 V2R3
TCAT-AS-000570 – Tomcat default ROOT web application must be removed.
Details The default ROOT web application includes the version of Tomcat that is being used, links to Tomcat documentation, examples,...TCAT-AS-000580 – Documentation must be removed.
Details Tomcat provides documentation and other directories in the default installation which do not serve a production use. These files...TCAT-AS-000590 – Applications in privileged mode must be approved by the ISSO.
Details The privileged attribute controls if a context (application) is allowed to use container provided servlets like the Manager servlet....TCAT-AS-000600 – Tomcat management applications must use LDAP realm authentication.
Details Using the local user store on a Tomcat installation does not meet a multitude of security control requirements related...TCAT-AS-000610 – JMX authentication must be secured.
Details Java Management Extensions (JMX) provides the means to remotely manage the Java VM. When enabling the JMX agent for...TCAT-AS-000630 – TLS must be enabled on JMX.
Details Java Management Extensions (JMX) provides the means for enterprises to remotely manage the Java VM and can be used...TCAT-AS-000530 – The deployXML attribute must be set to false in hosted environments.
Details The Host element controls deployment. Automatic deployment allows for simpler management, but also makes it easier for an attacker...TCAT-AS-000540 – Autodeploy must be disabled.
Details Tomcat allows auto-deployment of applications while Tomcat is running. This can allow untested or malicious applications to be automatically...TCAT-AS-000690 – LDAP authentication must be secured.
Details JNDIRealm is an implementation of the Tomcat Realm interface. Tomcat uses the JNDIRealm to look up users in an...