Tomcat servers must mutually authenticate proxy or load balancer connections.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-222971	TCAT-AS-000800	SV-222971r615938_rule		Medium

Description
Tomcat servers are often placed behind a proxy when exposed to both trusted and untrusted networks. This is done for security and performance reasons. Tomcat does provide an HTTP server that can be configured to make hosted applications available to clients directly. However, this HTTP server has performance limitations and is not intended to be used on an enterprise scale. Exposing this service to untrusted networks also violates the layered security model and creates elevated risk of attack. To address these issues, a proxy or load balancer can be placed in front of the Tomcat server. To ensure the proxied connection is not spoofed, SSL mutual authentication must be employed between Tomcat and the proxy. Not all Tomcat systems will have an RMF system categorization that warrants mutual authentication protections. The site must determine if mutual authentication is warranted based on their system RMF categorization and data protection requirements. If the site determines that MA is not a requirement, they can document a risk acceptance for not mutually authenticating proxy or load balancer connections due to operational issues, or when the RMF system categorization does not warrant the added level of protection.

Description

Tomcat servers are often placed behind a proxy when exposed to both trusted and untrusted networks. This is done for security and performance reasons. Tomcat does provide an HTTP server that can be configured to make hosted applications available to clients directly. However, this HTTP server has performance limitations and is not intended to be used on an enterprise scale. Exposing this service to untrusted networks also violates the layered security model and creates elevated risk of attack. To address these issues, a proxy or load balancer can be placed in front of the Tomcat server. To ensure the proxied connection is not spoofed, SSL mutual authentication must be employed between Tomcat and the proxy. Not all Tomcat systems will have an RMF system categorization that warrants mutual authentication protections. The site must determine if mutual authentication is warranted based on their system RMF categorization and data protection requirements. If the site determines that MA is not a requirement, they can document a risk acceptance for not mutually authenticating proxy or load balancer connections due to operational issues, or when the RMF system categorization does not warrant the added level of protection.

STIG	Date
Apache Tomcat Application Sever 9 Security Technical Implementation Guide	2020-12-11

Details

Check Text ( C-24643r426357_chk )
Review system security plan and/or system architecture documentation and interview the system admin. Identify any proxy servers or load balancers that provide services for the Tomcat server. If there are no load balancers or proxies in use, this is not a finding. If there is a documented risk acceptance for not mutually authenticating proxy or load balancer connections due to operational issues, or RMF system categorization this is not a finding. Using the aforementioned documentation, identify each Tomcat IP address that is served by a load balancer or proxy. From the Tomcat server as a privileged user, review the $CATALINA_BASE/conf/server.xml file. Review each element for the address setting and the clientAuth setting. sudo grep -i -B1 -A5 connector $CATALINA_BASE/conf/server.xml If a connector has a configured IP address that is proxied or load balanced and the clientAuth setting is not "true", this is a finding.

Check Text ( C-24643r426357_chk )

Review system security plan and/or system architecture documentation and interview the system admin. Identify any proxy servers or load balancers that provide services for the Tomcat server. If there are no load balancers or proxies in use, this is not a finding.

If there is a documented risk acceptance for not mutually authenticating proxy or load balancer connections due to operational issues, or RMF system categorization this is not a finding.

Using the aforementioned documentation, identify each Tomcat IP address that is served by a load balancer or proxy.

From the Tomcat server as a privileged user, review the $CATALINA_BASE/conf/server.xml file. Review each element for the address setting and the clientAuth setting.

sudo grep -i -B1 -A5 connector $CATALINA_BASE/conf/server.xml

If a connector has a configured IP address that is proxied or load balanced and the clientAuth setting is not "true", this is a finding.

Fix Text (F-24632r426358_fix)
From the Tomcat server as a privileged user, edit the $CATALINA_BASE/conf/server.xml file. Modify each element where the IP address is behind a proxy or load balancer. Set clientAuth="true" then identify the applications that are associated with the connector and edit the associated web.xml files. Assure the is set to CLIENT-CERT.