STIGQter STIGQter: STIG Summary: Apache Tomcat Application Server 9 Security Technical Implementation Guide Version: 3 Release: 4 Benchmark Date: 01 Apr 2026:

Changes to $CATALINA_HOME/lib/ folder must be logged.

DISA Rule

SV-223000r1193100_rule

Vulnerability Number

V-223000

Group Title

SRG-APP-000504-AS-000229

Rule Version

TCAT-AS-001592

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

From the Tomcat server as a privileged user:

1. Identify the home folder for the Tomcat server:
#grep -i -- 'catalina_home\|catalina_base' /etc/systemd/system/tomcat.service

Lines similar to the following should be returned:
Environment="CATALINA_HOME=/opt/tomcat"
Environment="CATALINA_BASE=/opt/tomcat"
where /opt/tomcat in the example will be referred to as <homefolderpath>

2. Add rules to a rules file. These files will typically be /etc/audit/rules.d/audit.rules or stig.rules. Open the rules file <rulesfile> in a text editor.

3. Alter or add the following line to the rules file, replacing <homefolderpath> with the actual path. (e.g., /opt/tomcat):
-w <homefolderpath>/lib -p wa -k tomcat

4. Load the rules, replacing <rulesfile> with the actual filename (e.g., audit.rules):
#auditctl -R <rulesfile>

5. Make the rules persistent:
#augenrules --load

Check Contents

Check the audit rules for the Tomcat folders. Run the following command from the Tomcat server as a privileged user:

sudo auditctl -l | grep $CATALINA_HOME/lib

If the results do not include "-w $CATALINA_HOME/lib -p wa -k tomcat" or if there are no results, this is a finding.

Vulnerability Number

V-223000

Documentable

False

Rule Version

TCAT-AS-001592

Severity Override Guidance

Check the audit rules for the Tomcat folders. Run the following command from the Tomcat server as a privileged user:

sudo auditctl -l | grep $CATALINA_HOME/lib

If the results do not include "-w $CATALINA_HOME/lib -p wa -k tomcat" or if there are no results, this is a finding.

Check Content Reference

M

Target Key

4094