STIGhubSTIGhub
STIGsSearchCompareAbout

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • VPAT
  • DISA STIG Library
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

Apache Tomcat Application Server 9 Security Technical Implementation Guide

Version

V3R4

Benchmark ID

Tomcat_Application_Server_9_STIG

Total Checks

79

Tags

webapplication
CAT I: 4CAT II: 54CAT III: 21

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSON

Checks (79)

V-222926LOWThe number of allowed simultaneous sessions to the manager application must be limited.V-222928LOWHTTP Strict Transport Security (HSTS) must be enabled.V-222930MEDIUMAccessLogValve must be configured for each application context.V-222931HIGHDefault password for keystore must be changed.V-222932MEDIUMCookies must have secure flag set.V-222933MEDIUMCookies must have http-only flag set.V-222934MEDIUMDefaultServlet must be set to readonly for PUT and DELETE.V-222935MEDIUMConnectors must be secured.V-222937MEDIUMTomcat servers behind a proxy or load balancer must log client IP.V-222938MEDIUMAccessLogValve must be configured per each virtual host.V-222939MEDIUMDate and time of events must be logged.V-222940MEDIUMRemote hostname must be logged.V-222941LOWHTTP status code must be logged.V-222942MEDIUMThe first line of request must be logged.V-222943MEDIUM$CATALINA_BASE/logs folder permissions must be set to 750.V-222944MEDIUMFiles in the $CATALINA_BASE/logs/ folder must have their permissions set to 640.V-222945MEDIUMFiles in the $CATALINA_BASE/conf/ folder must have their permissions set to 640.V-222946MEDIUM$CATALINA_BASE/conf folder permissions must be set to 750.V-222947MEDIUMJar files in the $CATALINA_HOME/bin/ folder must have their permissions set to 640.V-222948MEDIUM$CATALINA_HOME/bin folder permissions must be set to 750.V-222949MEDIUMTomcat user UMASK must be set to 0027.V-222950MEDIUMStack tracing must be disabled.V-222951MEDIUMThe shutdown port must be disabled.V-222952MEDIUMUnapproved connectors must be disabled.V-222953LOWDefaultServlet debug parameter must be disabled.V-222954LOWDefaultServlet directory listings parameter must be disabled.V-222955MEDIUMThe deployXML attribute must be set to false in hosted environments.V-222956MEDIUMAutodeploy must be disabled.V-222957LOWxpoweredBy attribute must be disabled.V-222958LOWExample applications must be removed.V-222959LOWTomcat default ROOT web application must be removed.V-222960LOWDocumentation must be removed.V-222961MEDIUMApplications in privileged mode must be approved by the ISSO.V-222962MEDIUMTomcat management applications must use LDAP realm authentication.V-222963MEDIUMJMX authentication must be secured.V-222964HIGHTLS must be enabled on JMX.V-222965HIGHLDAP authentication must be secured.V-222966MEDIUMDOD root CA certificates must be installed in Tomcat trust store.V-222967MEDIUMKeystore file must be protected.V-222968HIGHTomcat must use FIPS-validated ciphers on secured connectors.V-222969MEDIUMAccess to JMX management interface must be restricted.V-222970MEDIUMAccess to Tomcat manager application must be restricted.V-222971MEDIUMTomcat servers must mutually authenticate proxy or load balancer connections.V-222973LOWTomcat must be configured to limit data exposure between applications.V-222974MEDIUMClusters must operate on a trusted network.V-222975MEDIUMErrorReportValve showServerInfo must be set to false.V-222976LOWDefault error pages for manager application must be customized.V-222977MEDIUMErrorReportValve showReport must be set to false.V-222979MEDIUMIdle timeout for the management application must be set to 10 minutes.V-222980MEDIUMLockOutRealms must be used for management of Tomcat.V-222981MEDIUMLockOutRealms failureCount attribute must be set to 5 failed logins for admin users.V-222982LOWLockOutRealms lockOutTime attribute must be set to 600 seconds (10 minutes) for admin users.V-222983MEDIUMTomcat user account must be set to nologin.V-222984MEDIUMTomcat user account must be a non-privileged user.V-222985LOWApplication user name must be logged.V-222986MEDIUM$CATALINA_HOME folder must be owned by the root user, group tomcat.V-222987MEDIUM$CATALINA_BASE/conf/ folder must be owned by root, group tomcat.V-222988MEDIUM$CATALINA_BASE/logs/ folder must be owned by tomcat user, group tomcat.V-222989LOW$CATALINA_BASE/temp/ folder must be owned by tomcat user, group tomcat.V-222990LOW$CATALINA_BASE/temp folder permissions must be set to 750.V-222991MEDIUM$CATALINA_BASE/work/ folder must be owned by tomcat user, group tomcat.V-222993MEDIUMMultifactor certificate-based tokens (CAC) must be used when accessing the management interface.V-222994MEDIUMCertificates in the trust store must be issued/signed by an approved CA.V-222995MEDIUMThe application server, when categorized as a high availability system within RMF, must be in a high-availability (HA) cluster.V-222996MEDIUMTomcat server must be patched for security vulnerabilities.V-222997MEDIUMAccessLogValve must be configured for Catalina engine.V-222998MEDIUMChanges to $CATALINA_HOME/bin/ folder must be logged.V-222999MEDIUMChanges to $CATALINA_BASE/conf/ folder must be logged.V-223000MEDIUMChanges to $CATALINA_HOME/lib/ folder must be logged.V-223001LOWApplication servers must use NIST-approved or NSA-approved key management technology and processes.V-223002LOWSTRICT_SERVLET_COMPLIANCE must be set to true.V-223003LOWRECYCLE_FACADES must be set to true.V-223004MEDIUMALLOW_BACKSLASH must be set to false.V-223005MEDIUMENFORCE_ENCODING_IN_GET_WRITER must be set to true.V-223006MEDIUMTomcat users in a management role must be approved by the ISSO.V-223007LOWHosted applications must be documented in the system security plan.V-223008LOWConnectors must be approved by the ISSO.V-223009LOWConnector address attribute must be set.V-223010MEDIUMThe application server must alert the system administrator (SA) and information system security offer (ISSO), at a minimum, in the event of a log processing failure.