← Back to Apache Tomcat Application Server 9 Security Technical Implementation Guide

V-222930

CAT II (Medium)

AccessLogValve must be configured for each application context.

Rule ID

SV-222930r960765_rule

STIG

Apache Tomcat Application Server 9 Security Technical Implementation Guide

Version

V3R4

CCIs

CCI-000067, CCI-000130, CCI-000133, CCI-000134, CCI-000166, CCI-000169, CCI-000172

Discussion

Tomcat has the ability to host multiple contexts (applications) on one physical server by using the <Host><Context> attribute. This allows the admin to specify audit log settings on a per application basis. Satisfies: SRG-APP-000016-AS-000013, SRG-APP-000080-AS-000045, SRG-APP-000089-AS-000050, SRG-APP-000091-AS-000052, SRG-APP-000095-AS-000056, SRG-APP-000098-AS-000061, SRG-APP-000099-AS-000062

Check Content

As an elevated user on the Tomcat server:

Edit the $CATALINA_BASE/conf/server.xml file.

Review for all &lt;Context&gt; elements.

If a &lt;Valve className="org.apache.catalina.valves.AccessLogValve" .../&gt; element is not defined within each &lt;Context&gt; element, this is a finding.

EXAMPLE:

&lt;Context
...
&lt;Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
               prefix="application_name_log" suffix=".txt"
               pattern=""%h %l %t %u &amp;quot;%r&amp;quot; %s %b" /&gt;
  ...
/&gt;

Fix Text

As a privileged user on the Tomcat server:

Edit the $CATALINA_BASE/conf/server.xml file.

Create a &lt;Valve&gt; element that is nested within the &lt;Context&gt; element containing an AccessLogValve.

EXAMPLE:

&lt;Context 
...
&lt;Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
               prefix="application_name_log" suffix=".txt"
               pattern="%h %l %t %u &amp;quot;%r&amp;quot; %s %b" /&gt;
  ...
/&gt;

Restart the Tomcat server:
sudo systemctl restart tomcat
sudo systemctl daemon-reload