STIGQter: STIG Summary: Apache Tomcat Application Sever 9 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 22 Jan 2021:

The application server, when categorized as a high availability system within RMF, must be in a high-availability (HA) cluster.

DISA Rule

SV-222995r615938_rule

Vulnerability Number

V-222995

Group Title

SRG-APP-000435-AS-000069

Rule Version

TCAT-AS-001460

Severity

CAT II

CCI(s)

• CCI-002385 - The information system protects against or limits the effects of organization-defined types of denial of service attacks by employing organization-defined security safeguards.

Weight

10

Fix Recommendation

From the Tomcat server as a privileged user, modify the $CATALINA_BASE/conf/server.xml file.

Uncomment the "<Cluster/> object and configure the system into a cluster as per the Tomcat clustering documentation provided at the Tomcat website.

https://tomcat.apache.org/tomcat-9.0-doc/config/cluster.html

Check Contents

This requirement only applies to a system that is categorized as high within the Risk Management Framework (RMF).

Review the System Security Plan (SSP) or other system documentation that specifies the operational uptime requirements and RMF system categorization.

If the system is categorized as high, from the Tomcat server as a privileged user, run the following command:

sudo grep -i -A10 -B2 "Cluster" $CATALINA_BASE/conf/server.xml

If the <Cluster/> element is commented out, or no results returned, then the system is not clustered and this is a finding.

Vulnerability Number

V-222995

Documentable

False

Rule Version

TCAT-AS-001460

Severity Override Guidance

This requirement only applies to a system that is categorized as high within the Risk Management Framework (RMF).

Review the System Security Plan (SSP) or other system documentation that specifies the operational uptime requirements and RMF system categorization.

If the system is categorized as high, from the Tomcat server as a privileged user, run the following command:

sudo grep -i -A10 -B2 "Cluster" $CATALINA_BASE/conf/server.xml

If the <Cluster/> element is commented out, or no results returned, then the system is not clustered and this is a finding.

Check Content Reference

M

Target Key

4094

Comments