Idle timeout for management application must be set to 10 minutes.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-222992	TCAT-AS-001300	SV-222992r557518_rule		Medium

Description
Tomcat can set idle session timeouts on a per-application basis. The management application is provided with the Tomcat installation and is used to manage the applications that are installed on the Tomcat Server. Setting the idle timeout for the management application will kill the admin user's session after 10 minutes of inactivity. This will limit the opportunity for unauthorized persons to hijack the admin session. This setting will also affect the default timeout behavior of all hosted web applications. To adjust the individual hosted application settings that are not related to management of the system, modify the individual application web.xml file if application timeout requirements differ from the STIG.

Description

Tomcat can set idle session timeouts on a per-application basis. The management application is provided with the Tomcat installation and is used to manage the applications that are installed on the Tomcat Server. Setting the idle timeout for the management application will kill the admin user's session after 10 minutes of inactivity. This will limit the opportunity for unauthorized persons to hijack the admin session. This setting will also affect the default timeout behavior of all hosted web applications. To adjust the individual hosted application settings that are not related to management of the system, modify the individual application web.xml file if application timeout requirements differ from the STIG.

STIG	Date
Apache Tomcat Application Sever 9 Security Technical Implementation Guide	2020-09-23

Details

Check Text ( C-24664r426420_chk )
If manager and host-manager applications have been deleted from the system, this is not a finding. From the Tomcat server as a privileged user, run the following commands: sudo grep -i session-timeout $CATALINA_BASE/webapps/manager/META-INF/web.xml sudo grep -i session-timeout $CATALINA_BASE/conf/web.xml If the session-timeout setting is not configured to be 10 minutes in at least one of these files, this is a finding.

Check Text ( C-24664r426420_chk )

If manager and host-manager applications have been deleted from the system, this is not a finding.

From the Tomcat server as a privileged user, run the following commands:

sudo grep -i session-timeout $CATALINA_BASE/webapps/manager/META-INF/web.xml

sudo grep -i session-timeout
$CATALINA_BASE/conf/web.xml

If the session-timeout setting is not configured to be 10 minutes in at least one of these files, this is a finding.

Fix Text (F-24653r426421_fix)
If the manager and host-manager applications have been deleted from the system, this is not a finding. From the Tomcat server as a privileged user: To affect session timeout for all applications including the management application, edit the $CATALINA_BASE/conf/web.xml file. To affect session timeout for the management application only, edit the $CATALINA_BASE/webapps/manager/META-INF/web.xml file. Locate the session-timeout setting located within the session-config element. Modify the session-timeout setting to be 10 minutes. Save the file. sudo systemctl restart tomcat sudo systemctl daemon-reload

Fix Text (F-24653r426421_fix)

If the manager and host-manager applications have been deleted from the system, this is not a finding.

From the Tomcat server as a privileged user:

To affect session timeout for all applications including the management application, edit the $CATALINA_BASE/conf/web.xml file.

To affect session timeout for the management application only, edit the $CATALINA_BASE/webapps/manager/META-INF/web.xml file.

Locate the session-timeout setting located within the session-config element.

Modify the session-timeout setting to be 10 minutes.

Save the file.

sudo systemctl restart tomcat
sudo systemctl daemon-reload