10.2 Restrict access to the web administration application

Information

Limit access to the web administration application to only those with a justified need.

Rationale:

Limiting access to the least privilege will ensure only those people with justified need will have access to a resource. The web administration application should be limited to only administrators.

Solution

For the administration application, edit $CATALINA_HOME/conf/server.xml and uncomment the following:

<Valve className='org.apache.catalina.valves.RemoteAddrValve' allow='127.0.0.1'/>

Note: The RemoteAddrValve property expects a regular expression, therefore periods and other regular expression meta-characters must be escaped.

Default Value:

By default, this configuration is not present.

See Also

https://workbench.cisecurity.org/files/4107

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(2), 800-53|AC-6(5), CSCv7|4.7

Plugin: Unix

Control ID: 9b34d6bf36ab507b7e82e417be29726c19579b9f7213611f51a791a08ce6cfac