Keystore file must be protected.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-222967	TCAT-AS-000710	SV-222967r615938_rule		Medium

Description
Keystore file contains authentication information used to access application data and data resources. Access to the file must be protected. The default location is in the .keystore file stored in the home folder of the user account used to run Tomcat although some administrators may choose to locate the file elsewhere. The location will also be specified in the server.xml file.

STIG	Date
Apache Tomcat Application Sever 9 Security Technical Implementation Guide	2021-06-15

Details

Check Text ( C-24639r426345_chk )
Identify the location of the .keystore file. Refer to system documentation or review the server.xml file for a specified .keystore file location. From the Tomcat server console run the following command to check the server.xml file: sudo grep -i keystorefile $CATALINA_BASE/conf/server.xml Extract the location of the file from the output. Example: [keystorefile=/opt/tomcat/conf/] sudo ls -la [keystorefile location] If the file permissions are not set to 640 USER:root GROUP:tomcat, this is a finding. If the keystore file is not stored within the tomcat folder path, i.e. [/opt/tomcat/], this is a finding.

Check Text ( C-24639r426345_chk )

Identify the location of the .keystore file. Refer to system documentation or review the server.xml file for a specified .keystore file location.

From the Tomcat server console run the following command to check the server.xml file:

sudo grep -i keystorefile $CATALINA_BASE/conf/server.xml

Extract the location of the file from the output.

Example:
[keystorefile=/opt/tomcat/conf/]

sudo ls -la [keystorefile location]

If the file permissions are not set to 640 USER:root GROUP:tomcat, this is a finding.

If the keystore file is not stored within the tomcat folder path, i.e. [/opt/tomcat/], this is a finding.

Fix Text (F-24628r426346_fix)
Run the following commands on the Tomcat server: sudo chmod 640 [keystorefile] sudo chown root [keystorefile] sudo chgrp tomcat [keystorefile] Store the keystore file in a secured folder within the Tomcat folder path.