10.5 Rename the manager application - host-manager/manager.xml

Information

The manager application allows administrators to manage Tomcat remotely via a web interface. The manager application should be renamed to make it harder for attackers or automated scripts to locate.

Rationale:

By relocating the manager applications, an attacker will need to guess its location rather than simply navigate to the standard location in order to carry out an attack.

Solution

Perform the following to rename the manager application:

Rename the manager application XML file:

# mv $CATALINA_HOME/webapps/host-manager/manager.xml
$CATALINA_HOME/webapps/host-manager/<new-name>.xml

Update the docBase attribute within $CATALINA_HOME/webapps/host-manager/<new-name>.xml to $CATALINA_HOME/webapps/<new-name>

Move $CATALINA_HOME/webapps/manager to $CATALINA_HOME/webapps/<new-name>

# mv $CATALINA_HOME/webapps/manager $CATALINA_HOME/webapps/<new-name>

Default Value:

The default name of the manager application is manager and is located at:

$CATALINA_HOME/webapps/manager

References:

https://www.owasp.org/index.php/Securing_tomcat

See Also

https://workbench.cisecurity.org/files/2506

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, CSCv6|9.1, CSCv7|5.1

Plugin: Unix

Control ID: ff5906d8cd09f3cb326ee2159e41e05797840833f309ee12faf590c75f67cc8f