Changes to $CATALINA_BASE/conf/ folder must be logged.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-222999	TCAT-AS-001591	SV-222999r615938_rule		Medium

Description
The $CATALINA_BASE/conf folder contains configuration files for the Tomcat Catalina server. To provide forensic evidence in the event of file tampering, changes to contents in this folder must be logged. For Linux OS flavors other than Ubuntu, use the relevant OS commands. This can be done on the Ubuntu OS via the auditctl command. Using the -p wa flag set the permissions flag for a file system watch and logs file attribute and content change events into syslog.

Description

The $CATALINA_BASE/conf folder contains configuration files for the Tomcat Catalina server. To provide forensic evidence in the event of file tampering, changes to contents in this folder must be logged. For Linux OS flavors other than Ubuntu, use the relevant OS commands. This can be done on the Ubuntu OS via the auditctl command. Using the -p wa flag set the permissions flag for a file system watch and logs file attribute and content change events into syslog.

STIG	Date
Apache Tomcat Application Sever 9 Security Technical Implementation Guide	2020-12-11

Details

Check Text ( C-24671r426441_chk )
Run the following commands From the Tomcat server as a privileged user: Identify the home folder for the Tomcat server. sudo grep -i -- 'catalina_home\\|catalina_base' /etc/systemd/system/tomcat.service Check the audit rules for the Tomcat folders. sudo auditctl -l $CATALINA_HOME/bin \|grep -i conf If the results do not include -w $CATALINA_BASE/conf -p wa -k tomcat, or if there are no results, this is a finding.

Check Text ( C-24671r426441_chk )

Run the following commands From the Tomcat server as a privileged user:

Identify the home folder for the Tomcat server.

sudo grep -i -- 'catalina_home\|catalina_base' /etc/systemd/system/tomcat.service

Check the audit rules for the Tomcat folders.

sudo auditctl -l $CATALINA_HOME/bin |grep -i conf

If the results do not include -w $CATALINA_BASE/conf -p wa -k tomcat, or if there are no results, this is a finding.

Fix Text (F-24660r426442_fix)
From the Tomcat server as a privileged user, use the auditctl command. sudo auditctl -w $CATALINA_BASE/conf -p wa -k tomcat Validate the audit watch was created. sudo auditctl -l The user should see: -w $CATALINA_HOME/ -p wa -k tomcat