Disable deploy on startup of applications

낮음레벨 2자동tomcat

설명

Tomcat allows auto deployment of applications on startup. It is recommended that this capability be disabled. Every Host element in server.xml must set deployOnStartup="false" (the default is true). Reads $CATALINA_BASE (default /opt/tomcat) and $CATALINA_HOME (default: $CATALINA_BASE); set them for packaged installs (e.g. CATALINA_BASE=/var/lib/tomcat10, CATALINA_HOME=/usr/share/tomcat10). XML comments are ignored.

점검 방법

감사 방식: 셸 명령

shell

B=${CATALINA_BASE:-/opt/tomcat}; H=${CATALINA_HOME:-$B}; O=${TOMCAT_OWNER:-tomcat_admin}; G=${TOMCAT_GROUP:-tomcat}; x(){ [ -r "$1" ] || return 1; awk 'BEGIN{RS="<!--"} NR==1{print;next} {i=index($0,"-->"); if(i) print substr($0,i+3)}' "$1" | tr '\n\t\r' '   ' | tr '<' '\n'; }; s=$(x "$B/conf/server.xml") || exit 1; printf '%s\n' "$s" | awk 'function at(n,  r){if(match($0,"[[:space:]]" n "[[:space:]]*=[[:space:]]*[\"\047][^\"\047]*")){r=substr($0,RSTART,RLENGTH); sub(/^[^=]*=[[:space:]]*./,"",r); return r} return "-unset-"} /^Host[[:space:]]/{n++; if(at("deployOnStartup")!="false") bad=1} END{print (n>0&&!bad)?"compliant":"noncompliant"}'

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Set deployOnStartup="false" on each <Host> in server.xml. Restart Tomcat afterwards.

속성

운영 체제: 모두
태그: tomcatdeployment
참고 자료: CIS Apache Tomcat 10.1 Benchmark v1.0.0 - 9.2 Disable deploy on startup of applications

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target tomcat --level 2