V-222984

Discussion

Use a distinct non-privileged user account for running Tomcat. If Tomcat processes are compromised and a privileged user account is used to operate the Tomcat server processes, the entire system becomes compromised. Sample passwd file: tomcat:x:1001:1001::/opt/tomcat/usr/sbin/nologin The user ID is stored in field 3 of the passwd file.

Check Content

Run the following command to identify the Tomcat process UID:
ps -ef | { head -1; grep catalina; } | cut -f1 -d" "

Run the following command to obtain the OS user ID tied to the Tomcat process:
cat /etc/passwd|grep -i <UID>|cut -f3 -d:

Unless operationally necessary, the Tomcat process should not be tied to a privileged OS user ID. Depending on the operating system, privileged OS user IDs will typically be assigned user ID values <500 or <1000.

If the Tomcat process is running as a privileged user and is not documented and approved, this is a finding.

If the user ID field of the passwd file is set to 0, this is a finding.