Cis Tomcat8 V100 1.1

1.1 Remove extraneous files and directories

Profile Applicability

• Level 2

Description

The installation may provide example applications, documentation, and other directories which may not serve a production use.

Rationale

Removing sample resources is a defense in depth measure that reduces potential exposures introduced by these resources.

Audit Procedure

Perform the following to determine the existence of extraneous resources:

1. List all files extraneous files. The following should yield no output:

$ ls -l $CATALINA_HOME/webapps/docs \
    $CATALINA_HOME/webapps/examples

Remediation

Perform the following to remove extraneous resources:

1. The following should yield no output:

$ rm -rf $CATALINA_HOME/webapps/docs \
    $CATALINA_HOME/webapps/examples

If the Manager application is not utilized, also remove the following resources:

$ rm -rf $CATALINA_HOME/webapps/host-manager \
    $CATALINA_HOME/webapps/manager \
    $CATALINA_HOME/conf/Catalina/localhost/manager.xml

Default Value

"docs", "examples", "manager" and "host-manager" are default web applications shipped with Tomcat.

References

• None

CIS Controls

Profile / Assessment Status