UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

AccessLogValve must be configured per each virtual host.


Overview

Finding ID Version Rule ID IA Controls Severity
V-222938 TCAT-AS-000180 SV-222938r615938_rule Medium
Description
Application servers utilize role-based access controls in order to specify the individuals who are allowed to configure application component loggable events. The application server must be configured to select which personnel are assigned the role of selecting which loggable events are to be logged. Satisfies: SRG-APP-000090-AS-000051, SRG-APP-000095-AS-000056, SRG-APP-000100-AS-000063, SRG-APP-000101-AS-000072, SRG-APP-000503-AS-000228, SRG-APP-000505-AS-000230, SRG-APP-000506-AS-000231
STIG Date
Apache Tomcat Application Sever 9 Security Technical Implementation Guide 2021-12-27

Details

Check Text ( C-24610r426258_chk )
As an elevated user on the Tomcat server:

Edit the $CATALINA_BASE/conf/server.xml file.

Review for all elements.

If a element is not nested within each element, this is a finding.

EXAMPLE:
unpackWARs="true" autoDeploy="false">
...
prefix="localhost_access_log" suffix=".txt"
pattern="%h %l %t %u "%r" %s %b" />
...
Fix Text (F-24599r426259_fix)
As a privileged user on the Tomcat server:

Edit the $CATALINA_BASE/conf/server.xml file.

Create a element that is nested beneath the element containing an AccessLogValve.

EXAMPLE:
unpackWARs="true" autoDeploy="false">
...
prefix="localhost_access_log" suffix=".txt"
pattern="%h %l %t %u "%r" %s %b" />
...


Restart the Tomcat server:
sudo systemctl restart tomcat
sudo systemctl daemon-reload