TCAT-AS-000361 - Files in the $CATALINA_BASE/logs/ folder must have their permissions set to 640.

Information

Tomcat file permissions must be restricted. The standard configuration is to have all Tomcat files owned by root with group Tomcat. While root has read/write privileges, group only has read permissions, and world has no permissions. The exceptions are the logs, temp, and work directories that are owned by the Tomcat user rather than root. This means that even if an attacker compromises the Tomcat process, they cannot change the Tomcat configuration, deploy new web applications, or modify existing web applications. The Tomcat process runs with a umask of 0027 to maintain these permissions.

Solution

If operational/application requirements specify different file permissions, obtain ISSM risk acceptance and set permissions according to risk acceptance.

Run the following command on the Tomcat server:

sudo find $CATALINA_BASE/logs/* -follow -maxdepth 0 -type f -print0 | sudo xargs chmod 640 $CATALINA_BASE/logs/*

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apache_Tomcat_Application_Server_9_V3R1_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-9, CAT|II, CCI|CCI-000162, Rule-ID|SV-222944r960930_rule, STIG-ID|TCAT-AS-000361, STIG-Legacy|SV-111417, STIG-Legacy|V-102471, Vuln-ID|V-222944

Plugin: Unix

Control ID: abc5cef248d39ba8b1d823556f49a52d0853451c8f3bb585b5f5dbf3eca1b589