# Cis Tomcat101 10.19

> Ensure Manager Application Passwords are Encrypted (Manual)

- Skill: `cyberstrikeus/cis-tomcat101-10-19` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-tomcat101-10-19`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-tomcat101-10-19/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-tomcat101-10-19

---


# 10.19 Ensure Manager Application Passwords are Encrypted (Manual)

## Description

Apache Tomcat ships with a Manager Application which requires users with a role of `manager-gui`, `manager-status`, `manager-script`, and/or `manager-jmx` to authenticate. The usernames and passwords to log onto the Manager Application are stored in the `tomcat-users.xml` in plain text by default.

## Rationale

Storing passwords in plain text may allow users with access to read the `tomcat-users.xml` file to obtain the credentials of user who have been assigned roles for the Manager Application. This may allow for accounts to be compromised on Tomcat and elsewhere.

## Audit Procedure

Perform the following to determine if password digests are in use:

```bash
$ grep -i <login-config>|.\n|*<auth-method>DIGEST</auth-method>|.\n] *<realm-
name>UserDatabase</realm-name>:.\n|*</login-config>
$CATALINA_HOME/webapps/manager/WEB-INF/web.xml
```

If a Realm exists without a `digest` attribute or without a value for the `digest` attribute, this is a fail.

## Remediation

1. Generate the encrypted password:

```bash
cd $CATALINA_HOME/bin
digest.bat -a sha-256 YOURPASSWORD
```

This will return the original password followed by encrypted password:

```
YOURPASSWORD:240be518fabd27724db6f04eeb1da5967e31c72a9
c720a9
```

2. Replace the plain text password with the above encrypted password generated above in `CATALINA_HOME/conf/tomcat-user.xml` file as follows.

## Default Value

## References

## CIS Controls

| Controls Version | Control                                                                                                                                                                                                                                                                                 | IG 1 | IG 2 | IG 3 |
| ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- | ---- | ---- |
| v8               | 8.5 Collect Detailed Audit Logs<br>Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation. |      | ●    | ●    |
| v7               | 6.3 Enable Detailed Logging<br>Enable system logging to include detailed information such as an event source, date, user, timestamp, source addresses, destination addresses, and other useful elements.                                                                                |      | ●    | ●    |

## Profile

Level 1