cyberstrikeus CIS Apache Tomcat 7 - 1.1 Remove extraneous files and directories (Scored)
Profile Applicability
- Level 2
Description
The installation may provide example applications, documentation, and other directories which may not serve a production use.
Rationale
Removing sample resources is a defense in depth measure that reduces potential exposures introduced by these resources.
Impact
Removal of example applications and documentation reduces available attack surface.
Audit Procedure
Perform the following to determine the existence of extraneous resources:
- List all files extraneous files. The following should yield no output:
$ ls -l $CATALINA_HOME/webapps/js-examples \
$CATALINA_HOME/webapps/servlet-example \
$CATALINA_HOME/webapps/webdav \
$CATALINA_HOME/webapps/tomcat-docs \
$CATALINA_HOME/webapps/balancer \
$CATALINA_HOME/webapps/ROOT/admin \
$CATALINA_HOME/webapps/examples \
$CATALINA_HOME/server/webapps/host-manager \
$CATALINA_HOME/server/webapps/manager \
$CATALINA_HOME/conf/Catalina/localhost/host-manager.xml \
$CATALINA_HOME/conf/Catalina/localhost/manager.xml
Remediation
Perform the following to remove extraneous resources:
- The following should yield no output:
$ rm -rf $CATALINA_HOME/webapps/js-examples \
$CATALINA_HOME/webapps/servlet-example \
$CATALINA_HOME/webapps/webdav \
$CATALINA_HOME/webapps/tomcat-docs \
$CATALINA_HOME/webapps/balancer \
$CATALINA_HOME/bin/webapps/ROOT/admin \$CATALINA_HOME/webapps/examples
If the Manager application is not utilized, also remove the following resources:
$ rm -rf $CATALINA_HOME/server/webapps/host-manager \
$CATALINA_HOME/server/webapps/manager \
$CATALINA_HOME/conf/Catalina/localhost/host-manager.xml \
$CATALINA_HOME/conf/Catalina/localhost/manager.xml
Default Value
Depending on your install method, default extraneous resources will vary.
References
- CIS Apache Tomcat 7 Benchmark v1.0.0
CIS Controls
Version 7:
- 18.9 Limit Use of Live Operating System to Those That Are Needed
Assessment Status
- Scored
- Profile: Level 2