Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-222985 | TCAT-AS-001080 | SV-222985r615938_rule | Low |
Description |
---|
The access logfile format is defined within a Valve that implements the org.apache.catalina.valves.AccessLogValve interface within the /opt/tomcat/server.xml configuration file: The %u pattern code is included in the pattern element and logs the username used to authenticate to an application. Including the username pattern in the log configuration provides useful information about the application user who is logging in, which is critical for troubleshooting and forensic investigations. |
STIG | Date |
---|---|
Apache Tomcat Application Sever 9 Security Technical Implementation Guide | 2021-12-27 |
Check Text ( C-24657r426399_chk ) |
---|
As an elevated user on the Tomcat server: Edit the $CATALINA_BASE/conf/server.xml file. Review all "Valve" elements. If the pattern= statement does not include %u, this is a finding. EXAMPLE: ... pattern="%h %l %t %u "%r" %s %b" /> ... |
Fix Text (F-24646r426400_fix) |
---|
As a privileged user on the Tomcat server: Edit the $CATALINA_BASE/conf/server.xml file. Modify the EXAMPLE: ... pattern="%h %l %t %u "%r" %s %b" /> ... Restart the Tomcat server: sudo systemctl restart tomcat sudo systemctl daemon-reload |