STIGQter: STIG Summary: Apache Tomcat Application Sever 9 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 22 Jan 2021:

Idle timeout for management application must be set to 10 minutes.

DISA Rule

SV-222979r615938_rule

Vulnerability Number

V-222979

Group Title

SRG-APP-000295-AS-000263

Rule Version

TCAT-AS-000970

Severity

CAT II

CCI(s)

• CCI-002361 - The information system automatically terminates a user session after organization-defined conditions or trigger events requiring session disconnect.
• CCI-002038 - The organization requires users to reauthenticate upon organization-defined circumstances or situations requiring reauthentication.

Weight

10

Fix Recommendation

From the Tomcat server as a privileged user:

To affect session timeout for all applications including the management application, edit the:
$CATALINA_BASE/conf/web.xml file.

To affect session timeout for the management application only, edit the:
$CATALINA_BASE/webapps/manager/META-INF/web.xml file.

Locate the session-timeout setting located within the session-config element.

Modify the session-timeout setting to be 10 minutes.

Save the file.

sudo systemctl restart tomcat
sudo systemctl daemon-reload

Check Contents

If the manager application has been deleted from the system, this is not a finding.

From the Tomcat server as a privileged user, run the following commands:

sudo grep -i session-timeout $CATALINA_BASE/webapps/manager/META-INF/web.xml

sudo grep -i session-timeout
$CATALINA_BASE/conf/web.xml

If the session-timeout setting is not configured to be 10 minutes in at least one of these files, this is a finding.

Vulnerability Number

V-222979

Documentable

False

Rule Version

TCAT-AS-000970

Severity Override Guidance

If the manager application has been deleted from the system, this is not a finding.

From the Tomcat server as a privileged user, run the following commands:

sudo grep -i session-timeout $CATALINA_BASE/webapps/manager/META-INF/web.xml

sudo grep -i session-timeout
$CATALINA_BASE/conf/web.xml

If the session-timeout setting is not configured to be 10 minutes in at least one of these files, this is a finding.

Check Content Reference

M

Target Key

4094

Comments