UCF STIG Viewer Logo

$CATALINA_BASE/logs folder permissions must be set to 750.


Overview

Finding ID Version Rule ID IA Controls Severity
V-222943 TCAT-AS-000360 SV-222943r615938_rule Medium
Description
Tomcat file permissions must be restricted. The standard configuration is to have all Tomcat files owned by root with group Tomcat. While root has read/write privileges, group only has read permissions, and world has no permissions. The exceptions are the logs, temp, and work directories that are owned by the Tomcat user rather than root. This means that even if an attacker compromises the Tomcat process, they cannot change the Tomcat configuration, deploy new web applications, or modify existing web applications. The Tomcat process runs with a umask of 0027 to maintain these permissions.
STIG Date
Apache Tomcat Application Sever 9 Security Technical Implementation Guide 2020-12-11

Details

Check Text ( C-24615r426273_chk )
Access the Tomcat server from the command line and execute the following OS command:

sudo find $CATALINA_BASE/logs -follow -maxdepth 0 -type d \( \! -perm 750 \) -ls

If ISSM risk acceptance specifies deviation from requirement based on operational/application needs, this is not a finding if the permissions are set in accordance with the risk acceptance.

If no folders are displayed, this is not a finding.

If results indicate the $CATALINA_BASE/logs folder permissions are not set to 750, this is a finding.
Fix Text (F-24604r426274_fix)
If operational/application requirements specify different file permissions, obtain ISSM risk acceptance and set permissions according to risk acceptance.

Run the following command on the Tomcat server:

sudo find $CATALINA_BASE/logs -follow -maxdepth 0 -type d -print0 | sudo xargs chmod 750 $CATALINA_BASE/logs