TMA-TOMCAT-9.2
Disable deploy on startup of applications
LowLevel 2Automatedtomcat
Description
Tomcat allows auto deployment of applications on startup. It is recommended that this capability be disabled. Every Host element in server.xml must set deployOnStartup="false" (the default is true). Reads $CATALINA_BASE (default /opt/tomcat) and $CATALINA_HOME (default: $CATALINA_BASE); set them for packaged installs (e.g. CATALINA_BASE=/var/lib/tomcat10, CATALINA_HOME=/usr/share/tomcat10). XML comments are ignored.
How it is checked
Audit method: Shell command
shell
B=${CATALINA_BASE:-/opt/tomcat}; H=${CATALINA_HOME:-$B}; O=${TOMCAT_OWNER:-tomcat_admin}; G=${TOMCAT_GROUP:-tomcat}; x(){ [ -r "$1" ] || return 1; awk 'BEGIN{RS="<!--"} NR==1{print;next} {i=index($0,"-->"); if(i) print substr($0,i+3)}' "$1" | tr '\n\t\r' ' ' | tr '<' '\n'; }; s=$(x "$B/conf/server.xml") || exit 1; printf '%s\n' "$s" | awk 'function at(n, r){if(match($0,"[[:space:]]" n "[[:space:]]*=[[:space:]]*[\"\047][^\"\047]*")){r=substr($0,RSTART,RLENGTH); sub(/^[^=]*=[[:space:]]*./,"",r); return r} return "-unset-"} /^Host[[:space:]]/{n++; if(at("deployOnStartup")!="false") bad=1} END{print (n>0&&!bad)?"compliant":"noncompliant"}'- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Set deployOnStartup="false" on each <Host> in server.xml. Restart Tomcat afterwards.
Properties
- Operating systems
- Any
- Tags
- tomcatdeployment
- Reference
- CIS Apache Tomcat 10.1 Benchmark v1.0.0 - 9.2 Disable deploy on startup of applications
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target tomcat --level 2