TMA-TOMCAT-3.1

Set a nondeterministic Shutdown command value

MediaNivel 1Automatizadatomcat

Descripción

Tomcat listens on TCP port 8005 to accept shutdown requests. By connecting to this port and sending the SHUTDOWN command, all applications within Tomcat are halted. The shutdown port is not exposed to the network as it is bound to the loopback interface. It is recommended that a nondeterministic value be set for the shutdown attribute in $CATALINA_HOME/conf/server.xml. The Server element in server.xml must not use the default shutdown="SHUTDOWN"; expects 0 matches. Reads $CATALINA_BASE (default /opt/tomcat) and $CATALINA_HOME (default: $CATALINA_BASE); set them for packaged installs (e.g. CATALINA_BASE=/var/lib/tomcat10, CATALINA_HOME=/usr/share/tomcat10). XML comments are ignored.

Cómo se verifica

Método de auditoría: Comando de shell

shell

B=${CATALINA_BASE:-/opt/tomcat}; H=${CATALINA_HOME:-$B}; O=${TOMCAT_OWNER:-tomcat_admin}; G=${TOMCAT_GROUP:-tomcat}; x(){ [ -r "$1" ] || return 1; awk 'BEGIN{RS="<!--"} NR==1{print;next} {i=index($0,"-->"); if(i) print substr($0,i+3)}' "$1" | tr '\n\t\r' '   ' | tr '<' '\n'; }; s=$(x "$B/conf/server.xml") || exit 1; printf '%s\n' "$s" | grep -E '^Server[[:space:]]' | grep -Ec 'shutdown[[:space:]]*=[[:space:]]*.SHUTDOWN.' || true

Salida esperada: 0

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Set <Server shutdown="<long random string>" ...> in server.xml. Restart Tomcat afterwards.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: tomcatnetwork
Referencia: CIS Apache Tomcat 10.1 Benchmark v1.0.0 - 3.1 Set a nondeterministic Shutdown command value

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target tomcat