Disabling auto deployment of applications

NiedrigStufe 2Automatisierttomcat

Beschreibung

Tomcat allows auto deployment of applications while Tomcat is running. It is recommended that this capability be disabled. Every Host element in server.xml must set autoDeploy="false" (the default is true). Reads $CATALINA_BASE (default /opt/tomcat) and $CATALINA_HOME (default: $CATALINA_BASE); set them for packaged installs (e.g. CATALINA_BASE=/var/lib/tomcat10, CATALINA_HOME=/usr/share/tomcat10). XML comments are ignored.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

B=${CATALINA_BASE:-/opt/tomcat}; H=${CATALINA_HOME:-$B}; O=${TOMCAT_OWNER:-tomcat_admin}; G=${TOMCAT_GROUP:-tomcat}; x(){ [ -r "$1" ] || return 1; awk 'BEGIN{RS="<!--"} NR==1{print;next} {i=index($0,"-->"); if(i) print substr($0,i+3)}' "$1" | tr '\n\t\r' '   ' | tr '<' '\n'; }; s=$(x "$B/conf/server.xml") || exit 1; printf '%s\n' "$s" | awk 'function at(n,  r){if(match($0,"[[:space:]]" n "[[:space:]]*=[[:space:]]*[\"\047][^\"\047]*")){r=substr($0,RSTART,RLENGTH); sub(/^[^=]*=[[:space:]]*./,"",r); return r} return "-unset-"} /^Host[[:space:]]/{n++; if(at("autoDeploy")!="false") bad=1} END{print (n>0&&!bad)?"compliant":"noncompliant"}'

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Set autoDeploy="false" on each <Host> in server.xml. Restart Tomcat afterwards.

Eigenschaften

Betriebssysteme: Beliebig
Tags: tomcatdeployment
Referenz: CIS Apache Tomcat 10.1 Benchmark v1.0.0 - 9.1 Disabling auto deployment of applications

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target tomcat --level 2