STIGQter: STIG Summary: Apache Tomcat Application Server 9 Security Technical Implementation Guide Version: 3 Release: 4 Benchmark Date: 01 Apr 2026:

JMX authentication must be secured.

DISA Rule

SV-222963r960972_rule

Vulnerability Number

V-222963

Group Title

SRG-APP-000149-AS-000102

Rule Version

TCAT-AS-000610

Severity

CAT II

CCI(s)

• CCI-000765 - Implement multifactor authentication for network access to privileged accounts.

Weight

10

Fix Recommendation

If using JMX for management of the Tomcat server, start the Tomcat server by adding the following command line flags to the systemd startup scripts in /etc/systemd/system/tomcat.service.

Environment='CATALINA_OPTS -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.authenticate=true -Dcom.sun.management.jmxremote.ssl=true'

sudo systemctl start tomcat
sudo systemctl daemon-reload

Check Contents

From the Tomcat server run the following command:

sudo grep -I jmxremote.authenticate /etc/systemd/system/tomcat.service
sudo ps -ef |grep -i jmxremote

If the results are blank, this is not a finding.

If the results include:

-Dcom.sun.management.jmxremote.authenticate=false, this is a finding.

Vulnerability Number

V-222963

Documentable

False

Rule Version

TCAT-AS-000610

Severity Override Guidance

From the Tomcat server run the following command:

sudo grep -I jmxremote.authenticate /etc/systemd/system/tomcat.service
sudo ps -ef |grep -i jmxremote

If the results are blank, this is not a finding.

If the results include:

-Dcom.sun.management.jmxremote.authenticate=false, this is a finding.

Check Content Reference

M

Target Key

4094