CIS Apache Tomcat 10 Benchmark

This recommendation addresses remove sample applications on the Apache Tomcat 10 application server. Following this CIS benchmark guideline helps maintain a secure configuration and reduces the risk of compromise.

Implementing this recommendation reduces the risk of security compromise on the Apache Tomcat 10 application server. Unaddressed configuration weaknesses are frequently targeted by attackers during both automated scans and manual penetration testing.

ls $CATALINA_HOME/webapps/examples \
   $CATALINA_HOME/webapps/docs \
   $CATALINA_HOME/webapps/ROOT 2>/dev/null
# Should not exist

rm -rf $CATALINA_HOME/webapps/examples
rm -rf $CATALINA_HOME/webapps/docs
rm -rf $CATALINA_HOME/webapps/ROOT

This recommendation addresses remove manager & host-manager if not needed on the Apache Tomcat 10 application server. Following this CIS benchmark guideline helps maintain a secure configuration and reduces the risk of compromise.

Implementing this recommendation reduces the risk of security compromise on the Apache Tomcat 10 application server. Unaddressed configuration weaknesses are frequently targeted by attackers during both automated scans and manual penetration testing.

ls $CATALINA_HOME/webapps/manager \
   $CATALINA_HOME/webapps/host-manager 2>/dev/null

# If manager apps are not required:
rm -rf $CATALINA_HOME/webapps/manager
rm -rf $CATALINA_HOME/webapps/host-manager

Auto-Deployment should be disabled on the Apache Tomcat 10 application server. Disabling unnecessary features and services minimizes the attack surface and reduces the risk of exploitation.

Leaving Auto-Deployment active when it is not needed creates an unnecessary attack vector. Disabling it reduces the risk of exploitation and simplifies the security management of the Apache Tomcat 10 application server.

grep -i 'autoDeploy' $CATALINA_HOME/conf/server.xml
# Should be autoDeploy="false"

<!-- In server.xml, set Host attributes: -->
<Host ... autoDeploy="false" deployOnStartup="false">

This recommendation verifies that CATALINA_HOME Ownership Is Correct on the Apache Tomcat 10 application server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to cATALINA_HOME Ownership Is Correct may leave the Apache Tomcat 10 application server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

ls -ld $CATALINA_HOME
# Should be owned by tomcat:tomcat (or dedicated user)

chown -R tomcat:tomcat $CATALINA_HOME

This setting ensures that Conf Directory Permissions is restricted on the Apache Tomcat 10 application server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted Conf Directory Permissions could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Apache Tomcat 10 application server is essential for defense in depth.

stat -c '%a' $CATALINA_HOME/conf
stat -c '%a' $CATALINA_HOME/conf/*
# conf/ should be 700, files 600

chmod 700 $CATALINA_HOME/conf
chmod 600 $CATALINA_HOME/conf/*

This recommendation addresses run tomcat as a non-root user on the Apache Tomcat 10 application server. Following this CIS benchmark guideline helps maintain a secure configuration and reduces the risk of compromise.

Implementing this recommendation reduces the risk of security compromise on the Apache Tomcat 10 application server. Unaddressed configuration weaknesses are frequently targeted by attackers during both automated scans and manual penetration testing.

ps aux | grep '[c]atalina' | awk '{print $1}'
# Should NOT be root

# Create a dedicated user:
useradd -r -s /usr/sbin/nologin tomcat
chown -R tomcat:tomcat $CATALINA_HOME
# Start Tomcat as the tomcat user

the Shutdown Port should be disabled on the Apache Tomcat 10 application server. Disabling unnecessary features and services minimizes the attack surface and reduces the risk of exploitation.

Leaving the Shutdown Port active when it is not needed creates an unnecessary attack vector. Disabling it reduces the risk of exploitation and simplifies the security management of the Apache Tomcat 10 application server.

grep 'port=' $CATALINA_HOME/conf/server.xml | head -1
# <Server port="-1" shutdown="SHUTDOWN">

<!-- In server.xml: -->
<Server port="-1" shutdown="SHUTDOWN">

This recommendation addresses the configuration of Custom Error Pages on the Apache Tomcat 10 application server. Proper configuration ensures alignment with CIS security guidelines and reduces exposure to known attack vectors.

An improperly configured Custom Error Pages may create security weaknesses that attackers can exploit. Following the CIS recommendation ensures a consistent and auditable security posture for the Apache Tomcat 10 application server.

grep -A 2 'error-page' $CATALINA_HOME/conf/web.xml

<!-- In conf/web.xml, add custom error pages: -->
<error-page>
  <error-code>404</error-code>
  <location>/error.html</location>
</error-page>
<error-page>
  <error-code>500</error-code>
  <location>/error.html</location>
</error-page>

This recommendation verifies that Server Header Is Not Disclosed on the Apache Tomcat 10 application server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to server Header Is Not Disclosed may leave the Apache Tomcat 10 application server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep 'server=' $CATALINA_HOME/conf/server.xml
# Connector should have server="" attribute

<!-- In each Connector element in server.xml: -->
<Connector ... server=" " />

This setting controls whether X-Powered-By Header is disabled on the Apache Tomcat 10 application server. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving X-Powered-By Header enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Apache Tomcat 10 application server.

grep 'xpoweredBy' $CATALINA_HOME/conf/server.xml
# Should be xpoweredBy="false"

<Connector ... xpoweredBy="false" />

This recommendation verifies that TLS Is Enabled for All Connectors on the Apache Tomcat 10 application server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to tLS Is Enabled for All Connectors may leave the Apache Tomcat 10 application server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E 'SSLEnabled|sslProtocol' $CATALINA_HOME/conf/server.xml

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           SSLEnabled="true" maxThreads="150" scheme="https" secure="true">
  <SSLHostConfig>
    <Certificate certificateKeystoreFile="conf/keystore.jks"
                 certificateKeystorePassword="changeit" type="RSA" />
  </SSLHostConfig>
</Connector>

This setting controls whether Weak SSL/TLS Protocols is disabled on the Apache Tomcat 10 application server. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Weak SSL/TLS Protocols enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Apache Tomcat 10 application server.

grep 'sslEnabledProtocols' $CATALINA_HOME/conf/server.xml

<SSLHostConfig sslProtocol="TLS"
               protocols="TLSv1.3,TLSv1.2">

This recommendation addresses the proper configuration of AccessLogValve on the Apache Tomcat 10 application server. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of AccessLogValve can lead to security gaps that may be exploited by attackers. A properly configured Apache Tomcat 10 application server reduces exposure to both known vulnerabilities and configuration drift.

grep 'AccessLogValve' $CATALINA_HOME/conf/server.xml

<!-- In each Host element in server.xml: -->
<Valve className="org.apache.catalina.valves.AccessLogValve"
       directory="logs" prefix="access_log" suffix=".txt"
       pattern="%h %l %u %t &quot;%r&quot; %s %b %D" />

This recommendation verifies that Log Files Are Rotated on the Apache Tomcat 10 application server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to log Files Are Rotated may leave the Apache Tomcat 10 application server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep 'rotatable' $CATALINA_HOME/conf/server.xml
# Default is true — verify it is not set to false

Ensure rotatable="true" (default) is set on the AccessLogValve and configure external log rotation for catalina.out.

This recommendation verifies that Logging Level Is INFO or Higher on the Apache Tomcat 10 application server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to logging Level Is INFO or Higher may leave the Apache Tomcat 10 application server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep '.level' $CATALINA_HOME/conf/logging.properties
# Levels should be INFO, WARNING, or SEVERE — not FINE/FINER/FINEST

# In conf/logging.properties:
.handlers = 1catalina.org.apache.juli.AsyncFileHandler, java.util.logging.ConsoleHandler
1catalina.org.apache.juli.AsyncFileHandler.level = INFO

This recommendation addresses remove default users from tomcat-users.xml on the Apache Tomcat 10 application server. Following this CIS benchmark guideline helps maintain a secure configuration and reduces the risk of compromise.

Implementing this recommendation reduces the risk of security compromise on the Apache Tomcat 10 application server. Unaddressed configuration weaknesses are frequently targeted by attackers during both automated scans and manual penetration testing.

cat $CATALINA_HOME/conf/tomcat-users.xml
# Should not contain default users (admin, tomcat, role1, etc.)

<!-- Remove or comment out all default user/role entries.
     Only define necessary users with strong passwords. -->

This recommendation addresses use lockoutrealm to prevent brute-force attacks on the Apache Tomcat 10 application server. Following this CIS benchmark guideline helps maintain a secure configuration and reduces the risk of compromise.

Implementing this recommendation reduces the risk of security compromise on the Apache Tomcat 10 application server. Unaddressed configuration weaknesses are frequently targeted by attackers during both automated scans and manual penetration testing.

grep 'LockOutRealm' $CATALINA_HOME/conf/server.xml

<Realm className="org.apache.catalina.realm.LockOutRealm"
       failureCount="5" lockOutTime="300">
  <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
         resourceName="UserDatabase"/>
</Realm>

Access to Manager Application Access by IP should be restricted on the Apache Tomcat 10 application server. Limiting access enforces the principle of least privilege and prevents unauthorized use of sensitive functionality.

Implementing this recommendation reduces the risk of security compromise on the Apache Tomcat 10 application server. Unaddressed configuration weaknesses are frequently targeted by attackers during both automated scans and manual penetration testing.

cat $CATALINA_HOME/webapps/manager/META-INF/context.xml
# Check RemoteAddrValve allow pattern

<Context antiResourceLocking="false" privileged="true">
  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
         allow="127\.0\.0\.1|::1|10\.0\.0\.\d+" />
</Context>

Security Manager should be enabled on the Apache Tomcat 10 application server. Enabling this security feature provides additional protection and aligns the configuration with CIS benchmark recommendations.

Without Security Manager, the Apache Tomcat 10 application server may lack a critical defense layer. Enabling this control provides additional protection against common threats and aligns the configuration with security best practices.

# Check if Tomcat was started with -security flag:
ps aux | grep catalina | grep '\-security'

# Start Tomcat with Security Manager:
$CATALINA_HOME/bin/catalina.sh start -security
# Configure catalina.policy for required permissions

This setting controls whether CSRF Prevention Filter is enabled on the Apache Tomcat 10 application server. Enabling this feature strengthens the security posture by enforcing the recommended configuration via server.xml, web.xml, or Tomcat configuration files.

Without CSRF Prevention Filter enabled, the Apache Tomcat 10 application server may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

grep 'CsrfPreventionFilter' $CATALINA_HOME/conf/web.xml

<!-- In conf/web.xml: -->
<filter>
  <filter-name>CsrfPreventionFilter</filter-name>
  <filter-class>org.apache.catalina.filters.CsrfPreventionFilter</filter-class>
</filter>

This setting controls whether Directory Listing is disabled on the Apache Tomcat 10 application server. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Directory Listing enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Apache Tomcat 10 application server.

grep -A 5 'DefaultServlet' $CATALINA_HOME/conf/web.xml | grep 'listings'
# Should be <param-value>false</param-value>

<!-- In the default servlet definition in conf/web.xml: -->
<init-param>
  <param-name>listings</param-name>
  <param-value>false</param-value>
</init-param>

This recommendation addresses the proper configuration of HttpHeaderSecurityFilter on the Apache Tomcat 10 application server. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of HttpHeaderSecurityFilter can lead to security gaps that may be exploited by attackers. A properly configured Apache Tomcat 10 application server reduces exposure to both known vulnerabilities and configuration drift.

grep 'HttpHeaderSecurityFilter' $CATALINA_HOME/conf/web.xml

<filter>
  <filter-name>httpHeaderSecurity</filter-name>
  <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
  <init-param>
    <param-name>hstsEnabled</param-name>
    <param-value>true</param-value>
  </init-param>
</filter>

This recommendation configures the timeout for Session on the Apache Tomcat 10 application server. Appropriate timeout values limit the window of opportunity for attacks and ensure resources are released in a timely manner.

Failure to session Timeout Is Set may leave the Apache Tomcat 10 application server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep 'session-timeout' $CATALINA_HOME/conf/web.xml
# Should be 15 minutes or less

<session-config>
  <session-timeout>15</session-timeout>
</session-config>

This recommendation verifies that Session Cookies Are Secure on the Apache Tomcat 10 application server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to session Cookies Are Secure may leave the Apache Tomcat 10 application server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -A 5 'cookie-config' $CATALINA_HOME/conf/web.xml

<session-config>
  <session-timeout>15</session-timeout>
  <cookie-config>
    <http-only>true</http-only>
    <secure>true</secure>
  </cookie-config>
  <tracking-mode>COOKIE</tracking-mode>
</session-config>