TMA-TOMCAT-6.5

Ensure 'sslProtocol' is Configured Correctly for Secure Connectors

높음레벨 1자동tomcat

설명

The TLSv1.0 and TLSv1.1 protocols should be disabled via the sslProtocol directive. The TLSv1.0 protocol is vulnerable to information disclosure and both protocols lack support for modern cryptographic algorithms including authenticated encryption. The only SSL/TLS protocols which should be allowed are TLSv1.2 and the newer TLSv1.3 protocol. Every Connector with SSLEnabled="true" must set sslProtocol (on the Connector or its SSLHostConfig, also accepting protocols=) to TLSv1.2, TLSv1.3 or TLSv1.2+TLSv1.3. Compliant when no TLS connector exists. Reads $CATALINA_BASE (default /opt/tomcat) and $CATALINA_HOME (default: $CATALINA_BASE); set them for packaged installs (e.g. CATALINA_BASE=/var/lib/tomcat10, CATALINA_HOME=/usr/share/tomcat10). XML comments are ignored.

점검 방법

감사 방식: 셸 명령

shell

B=${CATALINA_BASE:-/opt/tomcat}; H=${CATALINA_HOME:-$B}; O=${TOMCAT_OWNER:-tomcat_admin}; G=${TOMCAT_GROUP:-tomcat}; x(){ [ -r "$1" ] || return 1; awk 'BEGIN{RS="<!--"} NR==1{print;next} {i=index($0,"-->"); if(i) print substr($0,i+3)}' "$1" | tr '\n\t\r' '   ' | tr '<' '\n'; }; s=$(x "$B/conf/server.xml") || exit 1; printf '%s\n' "$s" | awk 'function at(n,  r){if(match($0,"[[:space:]]" n "[[:space:]]*=[[:space:]]*[\"\047][^\"\047]*")){r=substr($0,RSTART,RLENGTH); sub(/^[^=]*=[[:space:]]*./,"",r); return r} return "-unset-"} function fin(){ if(!inc) return; inc=0; if(se){ n=split(pr,t,/[+, ]+/); k=0; for(i=1;i<=n;i++){ if(t[i]=="") continue; k++; if(t[i]!="TLSv1.2" && t[i]!="TLSv1.3") bad=1 } if(k==0) bad=1 } } /^Connector[[:space:]]/{fin(); inc=1; se=(at("SSLEnabled")=="true"); sc=at("scheme"); sx=at("secure"); pr=at("sslProtocol"); if(pr=="-unset-") pr=""; if($0~/\/>[[:space:]]*$/) fin(); next} /^SSLHostConfig[[:space:]]/ && inc {v=at("sslProtocol"); if(v=="-unset-") v=at("protocols"); if(v!="-unset-") pr=pr "," v} /^\/Connector>/{fin()} END{fin(); print bad?"noncompliant":"compliant"}'

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Set <SSLHostConfig sslProtocol="TLS" protocols="TLSv1.2+TLSv1.3"> (or sslProtocol="TLSv1.2+TLSv1.3") on every TLS connector in server.xml. Restart Tomcat afterwards.

속성

운영 체제: 모두
태그: tomcattls
참고 자료: CIS Apache Tomcat 10.1 Benchmark v1.0.0 - 6.5 Ensure 'sslProtocol' is Configured Correctly for Secure Connectors

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target tomcat