TMA-TOMCAT-6.5

Ensure 'sslProtocol' is Configured Correctly for Secure Connectors

高レベル 1自動tomcat

説明

The TLSv1.0 and TLSv1.1 protocols should be disabled via the sslProtocol directive. The TLSv1.0 protocol is vulnerable to information disclosure and both protocols lack support for modern cryptographic algorithms including authenticated encryption. The only SSL/TLS protocols which should be allowed are TLSv1.2 and the newer TLSv1.3 protocol. Every Connector with SSLEnabled="true" must set sslProtocol (on the Connector or its SSLHostConfig, also accepting protocols=) to TLSv1.2, TLSv1.3 or TLSv1.2+TLSv1.3. Compliant when no TLS connector exists. Reads $CATALINA_BASE (default /opt/tomcat) and $CATALINA_HOME (default: $CATALINA_BASE); set them for packaged installs (e.g. CATALINA_BASE=/var/lib/tomcat10, CATALINA_HOME=/usr/share/tomcat10). XML comments are ignored.

チェック方法

監査方法: シェルコマンド

shell

B=${CATALINA_BASE:-/opt/tomcat}; H=${CATALINA_HOME:-$B}; O=${TOMCAT_OWNER:-tomcat_admin}; G=${TOMCAT_GROUP:-tomcat}; x(){ [ -r "$1" ] || return 1; awk 'BEGIN{RS="<!--"} NR==1{print;next} {i=index($0,"-->"); if(i) print substr($0,i+3)}' "$1" | tr '\n\t\r' '   ' | tr '<' '\n'; }; s=$(x "$B/conf/server.xml") || exit 1; printf '%s\n' "$s" | awk 'function at(n,  r){if(match($0,"[[:space:]]" n "[[:space:]]*=[[:space:]]*[\"\047][^\"\047]*")){r=substr($0,RSTART,RLENGTH); sub(/^[^=]*=[[:space:]]*./,"",r); return r} return "-unset-"} function fin(){ if(!inc) return; inc=0; if(se){ n=split(pr,t,/[+, ]+/); k=0; for(i=1;i<=n;i++){ if(t[i]=="") continue; k++; if(t[i]!="TLSv1.2" && t[i]!="TLSv1.3") bad=1 } if(k==0) bad=1 } } /^Connector[[:space:]]/{fin(); inc=1; se=(at("SSLEnabled")=="true"); sc=at("scheme"); sx=at("secure"); pr=at("sslProtocol"); if(pr=="-unset-") pr=""; if($0~/\/>[[:space:]]*$/) fin(); next} /^SSLHostConfig[[:space:]]/ && inc {v=at("sslProtocol"); if(v=="-unset-") v=at("protocols"); if(v!="-unset-") pr=pr "," v} /^\/Connector>/{fin()} END{fin(); print bad?"noncompliant":"compliant"}'

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Set <SSLHostConfig sslProtocol="TLS" protocols="TLSv1.2+TLSv1.3"> (or sslProtocol="TLSv1.2+TLSv1.3") on every TLS connector in server.xml. Restart Tomcat afterwards.

プロパティ

オペレーティングシステム: すべて
タグ: tomcattls
参照: CIS Apache Tomcat 10.1 Benchmark v1.0.0 - 6.5 Ensure 'sslProtocol' is Configured Correctly for Secure Connectors

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target tomcat