Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-222938 | TCAT-AS-000180 | SV-222938r960882_rule | Medium |
Description |
---|
Application servers utilize role-based access controls in order to specify the individuals who are allowed to configure application component loggable events. The application server must be configured to select which personnel are assigned the role of selecting which loggable events are to be logged. Satisfies: SRG-APP-000090-AS-000051, SRG-APP-000095-AS-000056, SRG-APP-000100-AS-000063, SRG-APP-000101-AS-000072, SRG-APP-000503-AS-000228, SRG-APP-000505-AS-000230, SRG-APP-000506-AS-000231 |
STIG | Date |
---|---|
Apache Tomcat Application Server 9 Security Technical Implementation Guide | 2024-05-23 |
Check Text ( C-24610r426258_chk ) |
---|
As an elevated user on the Tomcat server: Edit the $CATALINA_BASE/conf/server.xml file. Review for all If a EXAMPLE: ... pattern="%h %l %t %u "%r" %s %b" /> ... |
Fix Text (F-24599r426259_fix) |
---|
As a privileged user on the Tomcat server: Edit the $CATALINA_BASE/conf/server.xml file. Create a EXAMPLE: ... pattern="%h %l %t %u "%r" %s %b" /> ... Restart the Tomcat server: sudo systemctl restart tomcat sudo systemctl daemon-reload |