TMA-TOMCAT-9.2
Disable deploy on startup of applications
BajaNivel 2Automatizadatomcat
Descripción
Tomcat allows auto deployment of applications on startup. It is recommended that this capability be disabled. Every Host element in server.xml must set deployOnStartup="false" (the default is true). Reads $CATALINA_BASE (default /opt/tomcat) and $CATALINA_HOME (default: $CATALINA_BASE); set them for packaged installs (e.g. CATALINA_BASE=/var/lib/tomcat10, CATALINA_HOME=/usr/share/tomcat10). XML comments are ignored.
Cómo se verifica
Método de auditoría: Comando de shell
shell
B=${CATALINA_BASE:-/opt/tomcat}; H=${CATALINA_HOME:-$B}; O=${TOMCAT_OWNER:-tomcat_admin}; G=${TOMCAT_GROUP:-tomcat}; x(){ [ -r "$1" ] || return 1; awk 'BEGIN{RS="<!--"} NR==1{print;next} {i=index($0,"-->"); if(i) print substr($0,i+3)}' "$1" | tr '\n\t\r' ' ' | tr '<' '\n'; }; s=$(x "$B/conf/server.xml") || exit 1; printf '%s\n' "$s" | awk 'function at(n, r){if(match($0,"[[:space:]]" n "[[:space:]]*=[[:space:]]*[\"\047][^\"\047]*")){r=substr($0,RSTART,RLENGTH); sub(/^[^=]*=[[:space:]]*./,"",r); return r} return "-unset-"} /^Host[[:space:]]/{n++; if(at("deployOnStartup")!="false") bad=1} END{print (n>0&&!bad)?"compliant":"noncompliant"}'- Salida esperada
compliant
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Set deployOnStartup="false" on each <Host> in server.xml. Restart Tomcat afterwards.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- tomcatdeployment
- Referencia
- CIS Apache Tomcat 10.1 Benchmark v1.0.0 - 9.2 Disable deploy on startup of applications
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
shell
tmaegis scan --target tomcat --level 2