Hi guys, Welcome to the Advanced Video Search Engine, and you are watching Tomcat application server security checks? Blue Team | STIGs | Java. That video is uploaded by ProfessorBlackOps - CyberSecurity for the people at 2021-01-28T12:13:27-08:00. We are promoting this video only for entertainment and educational purpose only. So, I hope you like & enjoy it. [hYO8ah1aquE]
| Name | Tomcat application server security checks? Blue Team | STIGs | Java |
| Video Uploader | Video From ProfessorBlackOps - CyberSecurity for the people |
| Upload Date | This Video Uploaded At 28-01-2021 20:13:27 |
| Video Discription | Tomcat application server security checks? Blue Team | STIGs | Java V-222931 high Default password for keystore must be changed. V-222964 high TLS must be enabled on JMX. V-222965 high LDAP authentication must be secured. V-222968 high Tomcat must use FIPS-validated ciphers on secured connectors. V-222927 medium "Secured connectors must be configured to use strong encryption ciphers. V-222929 medium "TLS 1.2 must be used on secured HTTP connectors. V-222930 medium "AccessLogValve must be configured for each application context. V-222932 medium Cookies must have secure flag set. V-222933 medium Cookies must have http-only flag set. V-222934 medium DefaultServlet must be set to readonly for PUT and DELETE. V-222935 medium Connectors must be secured. V-222936 medium The Java Security Manager must be enabled. V-222937 medium Tomcat servers behind a proxy or load balancer must log client IP. V-222938 medium "AccessLogValve must be configured per each virtual host. V-222939 medium Date and time of events must be logged. V-222940 medium Remote hostname must be logged. V-222942 medium The first line of request must be logged. V-222943 medium $CATALINA_BASE/logs folder permissions must be set to 750. V-222944 medium Files in the $CATALINA_BASE/logs/ folder must have their permissions set to 640. V-222945 medium Files in the $CATALINA_BASE/conf/ folder must have their permissions set to 640. V-222946 medium $CATALINA_BASE/conf folder permissions must be set to 750. V-222947 medium Jar files in the $CATALINA_HOME/bin/ folder must have their permissions set to 640. V-222948 medium $CATALINA_HOME/bin folder permissions must be set to 750. V-222949 medium Tomcat user UMASK must be set to 0027. V-222950 medium Stack tracing must be disabled. V-222951 medium The shutdown port must be disabled. V-222952 medium Unapproved connectors must be disabled. V-222955 medium The deployXML attribute must be set to false in hosted environments. V-222956 medium Autodeploy must be disabled. V-222961 medium Applications in privileged mode must be approved by the ISSO. V-222962 medium Tomcat management applications must use LDAP realm authentication. V-222963 medium JMX authentication must be secured. V-222966 medium DoD root CA certificates must be installed in Tomcat trust store. V-222967 medium Keystore file must be protected. V-222969 medium Access to JMX management interface must be restricted. V-222970 medium Access to Tomcat manager application must be restricted. V-222971 medium Tomcat servers must mutually authenticate proxy or load balancer connections. V-222974 medium Clusters must operate on a trusted network. V-222975 medium ErrorReportValve showServerInfo must be set to false. V-222977 medium ErrorReportValve showReport must be set to false. V-222979 medium Idle timeout for management application must be set to 10 minutes. V-222980 medium LockOutRealms must be used for management of Tomcat. V-222981 medium LockOutRealms failureCount attribute must be set to 5 failed logins for admin users. V-222983 medium Tomcat user account must be set to nologin. V-222984 medium Tomcat user account must be a non-privileged user. V-222986 medium $CATALINA_HOME folder must be owned by the root user, group tomcat. V-222987 medium $CATALINA_BASE/conf/ folder must be owned by root, group tomcat. V-222988 medium $CATALINA_BASE/logs/ folder must be owned by tomcat user, group tomcat. V-222991 medium $CATALINA_BASE/work/ folder must be owned by tomcat user, group tomcat. V-222992 medium Idle timeout for management application must be set to 10 minutes. V-222993 medium Multifactor certificate-based tokens (CAC) must be used when accessing the management interface. V-222994 medium Certificates in the trust store must be issued/signed by an approved CA. V-222995 medium The application server, when categorized as a high availability system within RMF, must be in a high-availability (HA) cluster. V-222996 medium Tomcat server must be patched for security vulnerabilities. V-222997 medium AccessLogValve must be configured for Catalina engine. V-222998 medium Changes to $CATALINA_HOME/bin/ folder must be logged. V-222999 medium Changes to $CATALINA_BASE/conf/ folder must be logged. V-223000 medium Changes to $CATALINA_HOME/lib/ folder must be logged. V-223004 medium ALLOW_BACKSLASH must be set to false. V-223005 medium ENFORCE_ENCODING_IN_GET_WRITER must be set to true. V-223006 medium Tomcat users in a management role must be approved by the ISSO. V-223010 medium "The application server must alert the SA and ISSO, at a minimum, in the event of a log processing failure. hYO8ah1aquE |
| Category | Science & Technology |
| Tags | Tomcat | Application Server | Security | STIG | Java | FIPS 140-2 | ProfessorBlackOps |
