TMA-TOMCAT-9.1
Disabling auto deployment of applications
LowLevel 2Automatedtomcat
Description
Tomcat allows auto deployment of applications while Tomcat is running. It is recommended that this capability be disabled. Every Host element in server.xml must set autoDeploy="false" (the default is true). Reads $CATALINA_BASE (default /opt/tomcat) and $CATALINA_HOME (default: $CATALINA_BASE); set them for packaged installs (e.g. CATALINA_BASE=/var/lib/tomcat10, CATALINA_HOME=/usr/share/tomcat10). XML comments are ignored.
How it is checked
Audit method: Shell command
shell
B=${CATALINA_BASE:-/opt/tomcat}; H=${CATALINA_HOME:-$B}; O=${TOMCAT_OWNER:-tomcat_admin}; G=${TOMCAT_GROUP:-tomcat}; x(){ [ -r "$1" ] || return 1; awk 'BEGIN{RS="<!--"} NR==1{print;next} {i=index($0,"-->"); if(i) print substr($0,i+3)}' "$1" | tr '\n\t\r' ' ' | tr '<' '\n'; }; s=$(x "$B/conf/server.xml") || exit 1; printf '%s\n' "$s" | awk 'function at(n, r){if(match($0,"[[:space:]]" n "[[:space:]]*=[[:space:]]*[\"\047][^\"\047]*")){r=substr($0,RSTART,RLENGTH); sub(/^[^=]*=[[:space:]]*./,"",r); return r} return "-unset-"} /^Host[[:space:]]/{n++; if(at("autoDeploy")!="false") bad=1} END{print (n>0&&!bad)?"compliant":"noncompliant"}'- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Set autoDeploy="false" on each <Host> in server.xml. Restart Tomcat afterwards.
Properties
- Operating systems
- Any
- Tags
- tomcatdeployment
- Reference
- CIS Apache Tomcat 10.1 Benchmark v1.0.0 - 9.1 Disabling auto deployment of applications
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target tomcat --level 2