Ensure 'sslProtocol' is Configured Correctly for Secure Connectors

HochStufe 1Automatisierttomcat

Beschreibung

The TLSv1.0 and TLSv1.1 protocols should be disabled via the sslProtocol directive. The TLSv1.0 protocol is vulnerable to information disclosure and both protocols lack support for modern cryptographic algorithms including authenticated encryption. The only SSL/TLS protocols which should be allowed are TLSv1.2 and the newer TLSv1.3 protocol. Every Connector with SSLEnabled="true" must set sslProtocol (on the Connector or its SSLHostConfig, also accepting protocols=) to TLSv1.2, TLSv1.3 or TLSv1.2+TLSv1.3. Compliant when no TLS connector exists. Reads $CATALINA_BASE (default /opt/tomcat) and $CATALINA_HOME (default: $CATALINA_BASE); set them for packaged installs (e.g. CATALINA_BASE=/var/lib/tomcat10, CATALINA_HOME=/usr/share/tomcat10). XML comments are ignored.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

B=${CATALINA_BASE:-/opt/tomcat}; H=${CATALINA_HOME:-$B}; O=${TOMCAT_OWNER:-tomcat_admin}; G=${TOMCAT_GROUP:-tomcat}; x(){ [ -r "$1" ] || return 1; awk 'BEGIN{RS="<!--"} NR==1{print;next} {i=index($0,"-->"); if(i) print substr($0,i+3)}' "$1" | tr '\n\t\r' '   ' | tr '<' '\n'; }; s=$(x "$B/conf/server.xml") || exit 1; printf '%s\n' "$s" | awk 'function at(n,  r){if(match($0,"[[:space:]]" n "[[:space:]]*=[[:space:]]*[\"\047][^\"\047]*")){r=substr($0,RSTART,RLENGTH); sub(/^[^=]*=[[:space:]]*./,"",r); return r} return "-unset-"} function fin(){ if(!inc) return; inc=0; if(se){ n=split(pr,t,/[+, ]+/); k=0; for(i=1;i<=n;i++){ if(t[i]=="") continue; k++; if(t[i]!="TLSv1.2" && t[i]!="TLSv1.3") bad=1 } if(k==0) bad=1 } } /^Connector[[:space:]]/{fin(); inc=1; se=(at("SSLEnabled")=="true"); sc=at("scheme"); sx=at("secure"); pr=at("sslProtocol"); if(pr=="-unset-") pr=""; if($0~/\/>[[:space:]]*$/) fin(); next} /^SSLHostConfig[[:space:]]/ && inc {v=at("sslProtocol"); if(v=="-unset-") v=at("protocols"); if(v!="-unset-") pr=pr "," v} /^\/Connector>/{fin()} END{fin(); print bad?"noncompliant":"compliant"}'

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Set <SSLHostConfig sslProtocol="TLS" protocols="TLSv1.2+TLSv1.3"> (or sslProtocol="TLSv1.2+TLSv1.3") on every TLS connector in server.xml. Restart Tomcat afterwards.

Eigenschaften

Betriebssysteme: Beliebig
Tags: tomcattls
Referenz: CIS Apache Tomcat 10.1 Benchmark v1.0.0 - 6.5 Ensure 'sslProtocol' is Configured Correctly for Secure Connectors

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target tomcat