2.1 Alter the Advertised server.info String

Information

The server.info attribute contains the name of the application service. This value is presented to Tomcat clients when clients connect to the Tomcat server.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Perform the following to alter the server platform string that gets displayed when clients connect to the tomcat server.
1. Extract the ServerInfo.properties file from the catalina.jar file:
$ cd $CATALINA_HOME/lib
$ jar xf catalina.jar org/apache/catalina/util/ServerInfo.properties
2. Navigate to the util directory that was created
cd org/apache/catalina/util
3. Open ServerInfo.properties in an editor
4. Update the server.info attribute in the ServerInfo.properties file.
server.info=<SomeWebServer>
5. Update the catalina.jar with the modified ServerInfo.properties file.
$ jar uf catalina.jar org/apache/catalina/util/ServerInfo.properties

See Also

https://workbench.cisecurity.org/files/266

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-30(5)

Plugin: Unix

Control ID: a0400ab2b6a57747ea8ab0473d9c80e328edbb3741c770b369cd094c52d01406