TMA-TOMCAT-6.5
Ensure 'sslProtocol' is Configured Correctly for Secure Connectors
Mô tả
The TLSv1.0 and TLSv1.1 protocols should be disabled via the sslProtocol directive. The TLSv1.0 protocol is vulnerable to information disclosure and both protocols lack support for modern cryptographic algorithms including authenticated encryption. The only SSL/TLS protocols which should be allowed are TLSv1.2 and the newer TLSv1.3 protocol. Every Connector with SSLEnabled="true" must set sslProtocol (on the Connector or its SSLHostConfig, also accepting protocols=) to TLSv1.2, TLSv1.3 or TLSv1.2+TLSv1.3. Compliant when no TLS connector exists. Reads $CATALINA_BASE (default /opt/tomcat) and $CATALINA_HOME (default: $CATALINA_BASE); set them for packaged installs (e.g. CATALINA_BASE=/var/lib/tomcat10, CATALINA_HOME=/usr/share/tomcat10). XML comments are ignored.
Cách kiểm tra
Phương pháp kiểm tra: Lệnh shell
B=${CATALINA_BASE:-/opt/tomcat}; H=${CATALINA_HOME:-$B}; O=${TOMCAT_OWNER:-tomcat_admin}; G=${TOMCAT_GROUP:-tomcat}; x(){ [ -r "$1" ] || return 1; awk 'BEGIN{RS="<!--"} NR==1{print;next} {i=index($0,"-->"); if(i) print substr($0,i+3)}' "$1" | tr '\n\t\r' ' ' | tr '<' '\n'; }; s=$(x "$B/conf/server.xml") || exit 1; printf '%s\n' "$s" | awk 'function at(n, r){if(match($0,"[[:space:]]" n "[[:space:]]*=[[:space:]]*[\"\047][^\"\047]*")){r=substr($0,RSTART,RLENGTH); sub(/^[^=]*=[[:space:]]*./,"",r); return r} return "-unset-"} function fin(){ if(!inc) return; inc=0; if(se){ n=split(pr,t,/[+, ]+/); k=0; for(i=1;i<=n;i++){ if(t[i]=="") continue; k++; if(t[i]!="TLSv1.2" && t[i]!="TLSv1.3") bad=1 } if(k==0) bad=1 } } /^Connector[[:space:]]/{fin(); inc=1; se=(at("SSLEnabled")=="true"); sc=at("scheme"); sx=at("secure"); pr=at("sslProtocol"); if(pr=="-unset-") pr=""; if($0~/\/>[[:space:]]*$/) fin(); next} /^SSLHostConfig[[:space:]]/ && inc {v=at("sslProtocol"); if(v=="-unset-") v=at("protocols"); if(v!="-unset-") pr=pr "," v} /^\/Connector>/{fin()} END{fin(); print bad?"noncompliant":"compliant"}'- Đầu ra mong đợi
compliant
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Set <SSLHostConfig sslProtocol="TLS" protocols="TLSv1.2+TLSv1.3"> (or sslProtocol="TLSv1.2+TLSv1.3") on every TLS connector in server.xml. Restart Tomcat afterwards.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- tomcattls
- Tham chiếu
- CIS Apache Tomcat 10.1 Benchmark v1.0.0 - 6.5 Ensure 'sslProtocol' is Configured Correctly for Secure Connectors
Kiểm tra máy này
Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.
tmaegis scan --target tomcat