Ensure 'sslProtocol' is Configured Correctly for Secure Connectors

AltaNivel 1Automatizadatomcat

Descripción

The TLSv1.0 and TLSv1.1 protocols should be disabled via the sslProtocol directive. The TLSv1.0 protocol is vulnerable to information disclosure and both protocols lack support for modern cryptographic algorithms including authenticated encryption. The only SSL/TLS protocols which should be allowed are TLSv1.2 and the newer TLSv1.3 protocol. Every Connector with SSLEnabled="true" must set sslProtocol (on the Connector or its SSLHostConfig, also accepting protocols=) to TLSv1.2, TLSv1.3 or TLSv1.2+TLSv1.3. Compliant when no TLS connector exists. Reads $CATALINA_BASE (default /opt/tomcat) and $CATALINA_HOME (default: $CATALINA_BASE); set them for packaged installs (e.g. CATALINA_BASE=/var/lib/tomcat10, CATALINA_HOME=/usr/share/tomcat10). XML comments are ignored.

Cómo se verifica

Método de auditoría: Comando de shell

shell

B=${CATALINA_BASE:-/opt/tomcat}; H=${CATALINA_HOME:-$B}; O=${TOMCAT_OWNER:-tomcat_admin}; G=${TOMCAT_GROUP:-tomcat}; x(){ [ -r "$1" ] || return 1; awk 'BEGIN{RS="<!--"} NR==1{print;next} {i=index($0,"-->"); if(i) print substr($0,i+3)}' "$1" | tr '\n\t\r' '   ' | tr '<' '\n'; }; s=$(x "$B/conf/server.xml") || exit 1; printf '%s\n' "$s" | awk 'function at(n,  r){if(match($0,"[[:space:]]" n "[[:space:]]*=[[:space:]]*[\"\047][^\"\047]*")){r=substr($0,RSTART,RLENGTH); sub(/^[^=]*=[[:space:]]*./,"",r); return r} return "-unset-"} function fin(){ if(!inc) return; inc=0; if(se){ n=split(pr,t,/[+, ]+/); k=0; for(i=1;i<=n;i++){ if(t[i]=="") continue; k++; if(t[i]!="TLSv1.2" && t[i]!="TLSv1.3") bad=1 } if(k==0) bad=1 } } /^Connector[[:space:]]/{fin(); inc=1; se=(at("SSLEnabled")=="true"); sc=at("scheme"); sx=at("secure"); pr=at("sslProtocol"); if(pr=="-unset-") pr=""; if($0~/\/>[[:space:]]*$/) fin(); next} /^SSLHostConfig[[:space:]]/ && inc {v=at("sslProtocol"); if(v=="-unset-") v=at("protocols"); if(v!="-unset-") pr=pr "," v} /^\/Connector>/{fin()} END{fin(); print bad?"noncompliant":"compliant"}'

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Set <SSLHostConfig sslProtocol="TLS" protocols="TLSv1.2+TLSv1.3"> (or sslProtocol="TLSv1.2+TLSv1.3") on every TLS connector in server.xml. Restart Tomcat afterwards.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: tomcattls
Referencia: CIS Apache Tomcat 10.1 Benchmark v1.0.0 - 6.5 Ensure 'sslProtocol' is Configured Correctly for Secure Connectors

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target tomcat