STIGQter STIGQter: STIG Summary: Apache Tomcat Application Sever 9 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 22 Jan 2021:

The number of allowed simultaneous sessions to the manager application must be limited.

DISA Rule

SV-222926r615938_rule

Vulnerability Number

V-222926

Group Title

SRG-APP-000001-AS-000001

Rule Version

TCAT-AS-000010

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Determine the number of authorized admins requiring simultaneous access and increase the number of allowed simultaneous sessions by a small percentage in order to address potential lockout scenarios. Document that value in the System Security Plan.

Review the maxActiveSessions setting in the $CATALINA_BASE/webapps/manager/ META-INF/context.xml configuration file.

Configure maxActiveSessions setting according to admin access requirements defined in the SSP.

EXAMPLE:
<Manager … maxActiveSessions="10" />

Check Contents

If the manager application is not in use or has been deleted from the system, this is not a finding.

From the Tomcat server as an elevated user run the following command:

sudo grep -i maxactivesessions $CATALINA_BASE/webapps/manager/ META-INF/context.xml

If the maxActiveSesions setting is not configured according to the number of connections defined in the SSP, this is a finding.

Vulnerability Number

V-222926

Documentable

False

Rule Version

TCAT-AS-000010

Severity Override Guidance

If the manager application is not in use or has been deleted from the system, this is not a finding.

From the Tomcat server as an elevated user run the following command:

sudo grep -i maxactivesessions $CATALINA_BASE/webapps/manager/ META-INF/context.xml

If the maxActiveSesions setting is not configured according to the number of connections defined in the SSP, this is a finding.

Check Content Reference

M

Target Key

4094

Comments