TMA-TOMCAT-3.2

Disable the Shutdown port

MediumLevel 2Automatedtomcat

Description

Tomcat listens on TCP port 8005 to accept shutdown requests. By connecting to this port and sending the SHUTDOWN command, all applications within Tomcat are halted. The shutdown port is not exposed to the network as it is bound to the loopback interface. If this functionality is not used, it is recommended that the shutdown port be disabled. The Server element in server.xml must have port="-1". Reads $CATALINA_BASE (default /opt/tomcat) and $CATALINA_HOME (default: $CATALINA_BASE); set them for packaged installs (e.g. CATALINA_BASE=/var/lib/tomcat10, CATALINA_HOME=/usr/share/tomcat10). XML comments are ignored.

How it is checked

Audit method: Shell command

shell

B=${CATALINA_BASE:-/opt/tomcat}; H=${CATALINA_HOME:-$B}; O=${TOMCAT_OWNER:-tomcat_admin}; G=${TOMCAT_GROUP:-tomcat}; x(){ [ -r "$1" ] || return 1; awk 'BEGIN{RS="<!--"} NR==1{print;next} {i=index($0,"-->"); if(i) print substr($0,i+3)}' "$1" | tr '\n\t\r' '   ' | tr '<' '\n'; }; s=$(x "$B/conf/server.xml") || exit 1; printf '%s\n' "$s" | grep -E '^Server[[:space:]]' | grep -Ec 'port[[:space:]]*=[[:space:]]*.-1.' || true

Expected output: 1

How it is fixed

Fix method: Guidance or infrastructure patch

Set <Server port="-1" ...> in server.xml. Restart Tomcat afterwards.

Properties

Operating systems: Any
Tags: tomcatnetwork
Reference: CIS Apache Tomcat 10.1 Benchmark v1.0.0 - 3.2 Disable the Shutdown port

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target tomcat --level 2