| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1 | <html><head><META http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><title>Apache Tomcat 7 (7.0.77) - Security Considerations</title><style type="text/css" media="print">
|
| 2 | .noPrint {display: none;}
|
| 3 | td#mainBody {width: 100%;}
|
| 4 | </style><style type="text/css">
|
| 5 | code {background-color:rgb(224,255,255);padding:0 0.1em;}
|
| 6 | code.attributeName, code.propertyName {background-color:transparent;}
|
| 7 |
|
| 8 |
|
| 9 | table {
|
| 10 | border-collapse: collapse;
|
| 11 | text-align: left;
|
| 12 | }
|
| 13 | table *:not(table) {
|
| 14 | /* Prevent border-collapsing for table child elements like <div> */
|
| 15 | border-collapse: separate;
|
| 16 | }
|
| 17 |
|
| 18 | th {
|
| 19 | text-align: left;
|
| 20 | }
|
| 21 |
|
| 22 |
|
| 23 | div.codeBox pre code, code.attributeName, code.propertyName, code.noHighlight, .noHighlight code {
|
| 24 | background-color: transparent;
|
| 25 | }
|
| 26 | div.codeBox {
|
| 27 | overflow: auto;
|
| 28 | margin: 1em 0;
|
| 29 | }
|
| 30 | div.codeBox pre {
|
| 31 | margin: 0;
|
| 32 | padding: 4px;
|
| 33 | border: 1px solid #999;
|
| 34 | border-radius: 5px;
|
| 35 | background-color: #eff8ff;
|
| 36 | display: table; /* To prevent <pre>s from taking the complete available width. */
|
| 37 | /*
|
| 38 | When it is officially supported, use the following CSS instead of display: table
|
| 39 | to prevent big <pre>s from exceeding the browser window:
|
| 40 | max-width: available;
|
| 41 | width: min-content;
|
| 42 | */
|
| 43 | }
|
| 44 |
|
| 45 | div.codeBox pre.wrap {
|
| 46 | white-space: pre-wrap;
|
| 47 | }
|
| 48 |
|
| 49 |
|
| 50 | table.defaultTable tr, table.detail-table tr {
|
| 51 | border: 1px solid #CCC;
|
| 52 | }
|
| 53 |
|
| 54 | table.defaultTable tr:nth-child(even), table.detail-table tr:nth-child(even) {
|
| 55 | background-color: #FAFBFF;
|
| 56 | }
|
| 57 |
|
| 58 | table.defaultTable tr:nth-child(odd), table.detail-table tr:nth-child(odd) {
|
| 59 | background-color: #EEEFFF;
|
| 60 | }
|
| 61 |
|
| 62 | table.defaultTable th, table.detail-table th {
|
| 63 | background-color: #88b;
|
| 64 | color: #fff;
|
| 65 | }
|
| 66 |
|
| 67 | table.defaultTable th, table.defaultTable td, table.detail-table th, table.detail-table td {
|
| 68 | padding: 5px 8px;
|
| 69 | }
|
| 70 |
|
| 71 |
|
| 72 | p.notice {
|
| 73 | border: 1px solid rgb(255, 0, 0);
|
| 74 | background-color: rgb(238, 238, 238);
|
| 75 | color: rgb(0, 51, 102);
|
| 76 | padding: 0.5em;
|
| 77 | margin: 1em 2em 1em 1em;
|
| 78 | }
|
| 79 | </style></head><body bgcolor="#ffffff" text="#000000" link="#525D76" alink="#525D76" vlink="#525D76"><table border="0" width="100%" cellspacing="0"><!--PAGE HEADER--><tr><td><!--PROJECT LOGO--><a href="http://tomcat.apache.org/"><img src="./images/tomcat.gif" align="right" alt="
|
| 80 | The Apache Tomcat Servlet/JSP Container
|
| 81 | " border="0"></a></td><td><h1><font face="arial,helvetica,sanserif">Apache Tomcat 7</font></h1><font face="arial,helvetica,sanserif">Version 7.0.77, Mar 28 2017</font></td><td><!--APACHE LOGO--><a href="http://www.apache.org/"><img src="./images/asf-logo.svg" align="right" alt="Apache Logo" border="0" style="width: 266px;height: 83px;"></a></td></tr></table><table border="0" width="100%" cellspacing="4"><!--HEADER SEPARATOR--><tr><td colspan="2"><hr noshade size="1"></td></tr><tr><!--LEFT SIDE NAVIGATION--><td width="20%" valign="top" nowrap class="noPrint"><p><strong>Links</strong></p><ul><li><a href="index.html">Docs Home</a></li><li><a href="http://wiki.apache.org/tomcat/FAQ">FAQ</a></li><li><a href="#comments_section">User Comments</a></li></ul><p><strong>User Guide</strong></p><ul><li><a href="introduction.html">1) Introduction</a></li><li><a href="setup.html">2) Setup</a></li><li><a href="appdev/index.html">3) First webapp</a></li><li><a href="deployer-howto.html">4) Deployer</a></li><li><a href="manager-howto.html">5) Manager</a></li><li><a href="realm-howto.html">6) Realms and AAA</a></li><li><a href="security-manager-howto.html">7) Security Manager</a></li><li><a href="jndi-resources-howto.html">8) JNDI Resources</a></li><li><a href="jndi-datasource-examples-howto.html">9) JDBC DataSources</a></li><li><a href="class-loader-howto.html">10) Classloading</a></li><li><a href="jasper-howto.html">11) JSPs</a></li><li><a href="ssl-howto.html">12) SSL/TLS</a></li><li><a href="ssi-howto.html">13) SSI</a></li><li><a href="cgi-howto.html">14) CGI</a></li><li><a href="proxy-howto.html">15) Proxy Support</a></li><li><a href="mbeans-descriptors-howto.html">16) MBeans Descriptors</a></li><li><a href="default-servlet.html">17) Default Servlet</a></li><li><a href="cluster-howto.html">18) Clustering</a></li><li><a href="balancer-howto.html">19) Load Balancer</a></li><li><a href="connectors.html">20) Connectors</a></li><li><a href="monitoring.html">21) Monitoring and Management</a></li><li><a href="logging.html">22) Logging</a></li><li><a href="apr.html">23) APR/Native</a></li><li><a href="virtual-hosting-howto.html">24) Virtual Hosting</a></li><li><a href="aio.html">25) Advanced IO</a></li><li><a href="extras.html">26) Additional Components</a></li><li><a href="maven-jars.html">27) Mavenized</a></li><li><a href="security-howto.html">28) Security Considerations</a></li><li><a href="windows-service-howto.html">29) Windows Service</a></li><li><a href="windows-auth-howto.html">30) Windows Authentication</a></li><li><a href="jdbc-pool.html">31) Tomcat's JDBC Pool</a></li><li><a href="web-socket-howto.html">32) WebSocket</a></li></ul><p><strong>Reference</strong></p><ul><li><a href="RELEASE-NOTES.txt">Release Notes</a></li><li><a href="config/index.html">Configuration</a></li><li><a href="api/index.html">Tomcat Javadocs</a></li><li><a href="servletapi/index.html">Servlet Javadocs</a></li><li><a href="jspapi/index.html">JSP 2.2 Javadocs</a></li><li><a href="elapi/index.html">EL 2.2 Javadocs</a></li><li><a href="websocketapi/index.html">WebSocket 1.1 Javadocs</a></li><li><a href="http://tomcat.apache.org/connectors-doc/">JK 1.2 Documentation</a></li></ul><p><strong>Apache Tomcat Development</strong></p><ul><li><a href="building.html">Building</a></li><li><a href="changelog.html">Changelog</a></li><li><a href="http://wiki.apache.org/tomcat/TomcatVersions">Status</a></li><li><a href="developers.html">Developers</a></li><li><a href="architecture/index.html">Architecture</a></li><li><a href="funcspecs/index.html">Functional Specs.</a></li><li><a href="tribes/introduction.html">Tribes</a></li></ul></td><!--RIGHT SIDE MAIN BODY--><td width="80%" valign="top" align="left" id="mainBody"><h1>Security Considerations</h1><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Table of Contents"><!--()--></a><a name="Table_of_Contents"><strong>Table of Contents</strong></a></font></td></tr><tr><td><blockquote>
|
| 82 | <ul><li><a href="#Introduction">Introduction</a></li><li><a href="#Non-Tomcat_settings">Non-Tomcat settings</a><ol><li><a href="#JMX">JMX</a></li></ol></li><li><a href="#Default_web_applications">Default web applications</a><ol><li><a href="#Default_web_applications/General">General</a></li><li><a href="#ROOT">ROOT</a></li><li><a href="#Documentation">Documentation</a></li><li><a href="#Examples">Examples</a></li><li><a href="#Default_web_applications/Manager">Manager</a></li><li><a href="#Host_Manager">Host Manager</a></li><li><a href="#Securing_Management_Applications">Securing Management Applications</a></li></ol></li><li><a href="#Security_manager">Security manager</a></li><li><a href="#server.xml">server.xml</a><ol><li><a href="#server.xml/General">General</a></li><li><a href="#Server">Server</a></li><li><a href="#Listeners">Listeners</a></li><li><a href="#Connectors">Connectors</a></li><li><a href="#Host">Host</a></li><li><a href="#Context">Context</a></li><li><a href="#Valves">Valves</a></li><li><a href="#Realms">Realms</a></li><li><a href="#server.xml/Manager">Manager</a></li><li><a href="#Cluster">Cluster</a></li></ol></li><li><a href="#System_Properties">System Properties</a></li><li><a href="#web.xml">web.xml</a></li><li><a href="#General">General</a></li></ul>
|
| 83 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
|
| 84 | <p>Tomcat is configured to be reasonably secure for most use cases by
|
| 85 | default. Some environments may require more, or less, secure configurations.
|
| 86 | This page is to provide a single point of reference for configuration
|
| 87 | options that may impact security and to offer some commentary on the
|
| 88 | expected impact of changing those options. The intention is to provide a
|
| 89 | list of configuration options that should be considered when assessing the
|
| 90 | security of a Tomcat installation.</p>
|
| 91 |
|
| 92 | <p><strong>Note</strong>: Reading this page is not a substitute for reading
|
| 93 | and understanding the detailed configuration documentation. Fuller
|
| 94 | descriptions of these attributes may be found in the relevant documentation
|
| 95 | pages.</p>
|
| 96 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Non-Tomcat settings"><!--()--></a><a name="Non-Tomcat_settings"><strong>Non-Tomcat settings</strong></a></font></td></tr><tr><td><blockquote>
|
| 97 | <p>Tomcat configuration should not be the only line of defense. The other
|
| 98 | components in the system (operating system, network, database, etc.) should
|
| 99 | also be secured.</p>
|
| 100 | <p>Tomcat should not be run under the root user. Create a dedicated user for
|
| 101 | the Tomcat process and provide that user with the minimum necessary
|
| 102 | permissions for the operating system. For example, it should not be possible
|
| 103 | to log on remotely using the Tomcat user.</p>
|
| 104 | <p>File permissions should also be suitably restricted. Taking the Tomcat
|
| 105 | instances at the ASF as an example (where auto-deployment is disabled and
|
| 106 | web applications are deployed as exploded directories), the standard
|
| 107 | configuration is to have all Tomcat files owned by root with group Tomcat
|
| 108 | and whilst owner has read/write privileges, group only has read and world
|
| 109 | has no permissions. The exceptions are the logs, temp and work directory
|
| 110 | that are owned by the Tomcat user rather than root. This means that even if
|
| 111 | an attacker compromises the Tomcat process, they can't change the
|
| 112 | Tomcat configuration, deploy new web applications or modify existing web
|
| 113 | applications. The Tomcat process runs with a umask of 007 to maintain these
|
| 114 | permissions.</p>
|
| 115 | <p>At the network level, consider using a firewall to limit both incoming
|
| 116 | and outgoing connections to only those connections you expect to be
|
| 117 | present.</p>
|
| 118 |
|
| 119 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="JMX"><strong>JMX</strong></a></font></td></tr><tr><td><blockquote>
|
| 120 | <p>The security of the JMX connection is dependent on the implementation
|
| 121 | provided by the JRE and therefore falls outside the control of Tomact.</p>
|
| 122 |
|
| 123 | <p>Typically, access control is very limited (either read-only to
|
| 124 | everything or read-write to everything). Tomcat exposes a large amount
|
| 125 | of internal information and control via JMX to aid debugging, monitoring
|
| 126 | and management. Give the limited access control available, JMX access
|
| 127 | should be treated as equivalent to local root/admin access and restricted
|
| 128 | accordingly.</p>
|
| 129 |
|
| 130 | <p>The JMX access control provided by most (all?) JRE vendors does not
|
| 131 | log failed authentication attempts, nor does it provide an account
|
| 132 | lock-out feature after repeated failed authentications. This makes a
|
| 133 | brute force attack easy to mount and difficult to detect.</p>
|
| 134 |
|
| 135 | <p>Given all of the above, care should be taken to ensure that, if used,
|
| 136 | the JMX interface is appropriately secured. Options you may wish to
|
| 137 | consider to secure the JMX interface include:</p>
|
| 138 |
|
| 139 | <ul>
|
| 140 | <li>configuring a strong password for all JMX users;</li>
|
| 141 | <li>binding the JMX listener only to an internal network;</li>
|
| 142 | <li>limiting network access to the JMX port to trusted clients; and</li>
|
| 143 | <li>providing an application specific health page for use by external
|
| 144 | monitoring systems.</li>
|
| 145 | </ul>
|
| 146 | </blockquote></td></tr></table>
|
| 147 |
|
| 148 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Default web applications"><!--()--></a><a name="Default_web_applications"><strong>Default web applications</strong></a></font></td></tr><tr><td><blockquote>
|
| 149 |
|
| 150 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Default web applications/General"><!--()--></a><a name="Default_web_applications/General"><strong>General</strong></a></font></td></tr><tr><td><blockquote>
|
| 151 | <p>Tomcat ships with a number of web applications that are enabled by
|
| 152 | default. Vulnerabilities have been discovered in these applications in the
|
| 153 | past. Applications that are not required should be removed so the system
|
| 154 | will not be at risk if another vulnerability is discovered.</p>
|
| 155 | </blockquote></td></tr></table>
|
| 156 |
|
| 157 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="ROOT"><strong>ROOT</strong></a></font></td></tr><tr><td><blockquote>
|
| 158 | <p>The ROOT web application presents a very low security risk but it does
|
| 159 | include the version of Tomcat that is being used. The ROOT web application
|
| 160 | should normally be removed from a publicly accessible Tomcat instance, not
|
| 161 | for security reasons, but so that a more appropriate default page is shown
|
| 162 | to users.</p>
|
| 163 | </blockquote></td></tr></table>
|
| 164 |
|
| 165 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Documentation"><strong>Documentation</strong></a></font></td></tr><tr><td><blockquote>
|
| 166 | <p>The documentation web application presents a very low security risk but
|
| 167 | it does identify the version of Tomcat that is being used. It should
|
| 168 | normally be removed from a publicly accessible Tomcat instance.</p>
|
| 169 | </blockquote></td></tr></table>
|
| 170 |
|
| 171 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Examples"><strong>Examples</strong></a></font></td></tr><tr><td><blockquote>
|
| 172 | <p>The examples web application should always be removed from any security
|
| 173 | sensitive installation. While the examples web application does not
|
| 174 | contain any known vulnerabilities, it is known to contain features
|
| 175 | (particularly the cookie examples that display the contents of all
|
| 176 | received and allow new cookies to be set) that may be used by an attacker
|
| 177 | in conjunction with a vulnerability in another application deployed on the
|
| 178 | Tomcat instance to obtain additional information that would otherwise be
|
| 179 | unavailable.</p>
|
| 180 | </blockquote></td></tr></table>
|
| 181 |
|
| 182 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Default web applications/Manager"><!--()--></a><a name="Default_web_applications/Manager"><strong>Manager</strong></a></font></td></tr><tr><td><blockquote>
|
| 183 | <p>The Manager application allows the remote deployment of web
|
| 184 | applications and is frequently targeted by attackers due to the widespread
|
| 185 | use of weak passwords and publicly accessible Tomcat instances with the
|
| 186 | Manager application enabled. The Manager application is not accessible by
|
| 187 | default as no users are configured with the necessary access. If the
|
| 188 | Manager application is enabled then guidance in the section
|
| 189 | <strong>Securing Management Applications</strong> section should be
|
| 190 | followed.</p>
|
| 191 | </blockquote></td></tr></table>
|
| 192 |
|
| 193 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Host Manager"><!--()--></a><a name="Host_Manager"><strong>Host Manager</strong></a></font></td></tr><tr><td><blockquote>
|
| 194 | <p>The Host Manager application allows the creation and management of
|
| 195 | virtual hosts - including the enabling of the Manager application for a
|
| 196 | virtual host. The Host Manager application is not accessible by default
|
| 197 | as no users are configured with the necessary access. If the Host Manager
|
| 198 | application is enabled then guidance in the section <strong>Securing
|
| 199 | Management Applications</strong> section should be followed.</p>
|
| 200 | </blockquote></td></tr></table>
|
| 201 |
|
| 202 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Securing Management Applications"><!--()--></a><a name="Securing_Management_Applications"><strong>Securing Management Applications</strong></a></font></td></tr><tr><td><blockquote>
|
| 203 | <p>When deploying a web application that provides management functions for
|
| 204 | the Tomcat instance, the following guidelines should be followed:</p>
|
| 205 | <ul>
|
| 206 | <li>Ensure that any users permitted to access the management application
|
| 207 | have strong passwords.</li>
|
| 208 | <li>Do not remove the use of the <a href="config/realm.html#LockOut_Realm_-_org.apache.catalina.realm.LockOutRealm">LockOutRealm</a>
|
| 209 | which prevents brute force attacks against user passwords.</li>
|
| 210 | <li>Uncomment the <a href="config/valve.html#Remote_Address_Filter">RemoteAddrValve</a>
|
| 211 | in <code>/META-INF/context.xml</code> which limits access to
|
| 212 | localhost. If remote access is required, limit it to specific IP
|
| 213 | addresses using this valve.</li>
|
| 214 | </ul>
|
| 215 | </blockquote></td></tr></table>
|
| 216 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Security manager"><!--()--></a><a name="Security_manager"><strong>Security manager</strong></a></font></td></tr><tr><td><blockquote>
|
| 217 | <p>Enabling the security manager causes web applications to be run in a
|
| 218 | sandbox, significantly limiting a web application's ability to perform
|
| 219 | malicious actions such as calling System.exit(), establishing network
|
| 220 | connections or accessing the file system outside of the web application's
|
| 221 | root and temporary directories. However, it should be noted that there are
|
| 222 | some malicious actions, such as triggering high CPU consumption via an
|
| 223 | infinite loop, that the security manager cannot prevent.</p>
|
| 224 |
|
| 225 | <p>Enabling the security manager is usually done to limit the potential
|
| 226 | impact, should an attacker find a way to compromise a trusted web
|
| 227 | application . A security manager may also be used to reduce the risks of
|
| 228 | running untrusted web applications (e.g. in hosting environments) but it
|
| 229 | should be noted that the security manager only reduces the risks of
|
| 230 | running untrusted web applications, it does not eliminate them. If running
|
| 231 | multiple untrusted web applications, it is recommended that each web
|
| 232 | application is deployed to a separate Tomcat instance (and ideally separate
|
| 233 | hosts) to reduce the ability of a malicious web application impacting the
|
| 234 | availability of other applications.</p>
|
| 235 |
|
| 236 | <p>Tomcat is tested with the security manager enabled; but the majority of
|
| 237 | Tomcat users do not run with a security manager, so Tomcat is not as well
|
| 238 | user-tested in this configuration. There have been, and continue to be,
|
| 239 | bugs reported that are triggered by running under a security manager.</p>
|
| 240 |
|
| 241 | <p>The restrictions imposed by a security manager are likely to break most
|
| 242 | applications if the security manager is enabled. The security manager should
|
| 243 | not be used without extensive testing. Ideally, the use of a security
|
| 244 | manager should be introduced at the start of the development cycle as it can
|
| 245 | be time-consuming to track down and fix issues caused by enabling a security
|
| 246 | manager for a mature application.</p>
|
| 247 |
|
| 248 | <p>Enabling the security manager changes the defaults for the following
|
| 249 | settings:</p>
|
| 250 | <ul>
|
| 251 | <li>The default value for the <strong>deployXML</strong> attribute of the
|
| 252 | <strong>Host</strong> element is changed to <code>false</code>.</li>
|
| 253 | </ul>
|
| 254 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="server.xml"><strong>server.xml</strong></a></font></td></tr><tr><td><blockquote>
|
| 255 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="server.xml/General"><strong>General</strong></a></font></td></tr><tr><td><blockquote>
|
| 256 | <p>The default server.xml contains a large number of comments, including
|
| 257 | some example component definitions that are commented out. Removing these
|
| 258 | comments makes it considerably easier to read and comprehend
|
| 259 | server.xml.</p>
|
| 260 | <p>If a component type is not listed, then there are no settings for that
|
| 261 | type that directly impact security.</p>
|
| 262 | </blockquote></td></tr></table>
|
| 263 |
|
| 264 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Server"><strong>Server</strong></a></font></td></tr><tr><td><blockquote>
|
| 265 | <p>Setting the <strong>port</strong> attribute to <code>-1</code> disables
|
| 266 | the shutdown port.</p>
|
| 267 | <p>If the shutdown port is not disabled, a strong password should be
|
| 268 | configured for <strong>shutdown</strong>.</p>
|
| 269 | </blockquote></td></tr></table>
|
| 270 |
|
| 271 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Listeners"><strong>Listeners</strong></a></font></td></tr><tr><td><blockquote>
|
| 272 | <p>The APR Lifecycle Listener is not stable if compiled on Solaris using
|
| 273 | gcc. If using the APR/native connector on Solaris, compile it with the
|
| 274 | Sun Studio compiler.</p>
|
| 275 |
|
| 276 | <p>The Security Listener should be enabled and configured as appropriate.
|
| 277 | </p>
|
| 278 | </blockquote></td></tr></table>
|
| 279 |
|
| 280 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Connectors"><strong>Connectors</strong></a></font></td></tr><tr><td><blockquote>
|
| 281 | <p>By default, an HTTP and an AJP connector are configured. Connectors
|
| 282 | that will not be used should be removed from server.xml.</p>
|
| 283 |
|
| 284 | <p>The <strong>address</strong> attribute may be used to control which IP
|
| 285 | address the connector listens on for connections. By default, the
|
| 286 | connector listens on all configured IP addresses.</p>
|
| 287 |
|
| 288 | <p>The <strong>allowTrace</strong> attribute may be used to enable TRACE
|
| 289 | requests which can be useful for debugging. Due to the way some browsers
|
| 290 | handle the response from a TRACE request (which exposes the browser to an
|
| 291 | XSS attack), support for TRACE requests is disabled by default.</p>
|
| 292 |
|
| 293 | <p>The <strong>maxPostSize</strong> attribute controls the maximum size
|
| 294 | of a POST request that will be parsed for parameters. The parameters are
|
| 295 | cached for the duration of the request so this is limited to 2MB by
|
| 296 | default to reduce exposure to a DOS attack.</p>
|
| 297 |
|
| 298 | <p>The <strong>maxSavePostSize</strong> attribute controls the saving of
|
| 299 | POST requests during FORM and CLIENT-CERT authentication. The parameters
|
| 300 | are cached for the duration of the authentication (which may be many
|
| 301 | minutes) so this is limited to 4KB by default to reduce exposure to a DOS
|
| 302 | attack.</p>
|
| 303 |
|
| 304 | <p>The <strong>maxParameterCount</strong> attribute controls the
|
| 305 | maximum number of parameter and value pairs (GET plus POST) that can
|
| 306 | be parsed and stored in the request. Excessive parameters are ignored.
|
| 307 | If you want to reject such requests, configure a
|
| 308 | <a href="config/filter.html">FailedRequestFilter</a>.</p>
|
| 309 |
|
| 310 | <p>The <strong>xpoweredBy</strong> attribute controls whether or not the
|
| 311 | X-Powered-By HTTP header is sent with each request. If sent, the value of
|
| 312 | the header contains the Servlet and JSP specification versions, the full
|
| 313 | Tomcat version (e.g. Apache Tomcat/7.0.0), the name of the JVM vendor and
|
| 314 | the version of the JVM. This header is disabled by default. This header
|
| 315 | can provide useful information to both legitimate clients and attackers.
|
| 316 | </p>
|
| 317 |
|
| 318 | <p>The <strong>server</strong> attribute controls the value of the Server
|
| 319 | HTTP header. The default value of this header for Tomcat 4.1.x, 5.0.x,
|
| 320 | 5.5.x, 6.0.x and 7.0.x is Apache-Coyote/1.1. This header can provide
|
| 321 | limited information to both legitimate clients and attackers.</p>
|
| 322 |
|
| 323 | <p>The <strong>SSLEnabled</strong>, <strong>scheme</strong> and
|
| 324 | <strong>secure</strong> attributes may all be independently set. These are
|
| 325 | normally used when Tomcat is located behind a reverse proxy and the proxy
|
| 326 | is connecting to Tomcat via HTTP or HTTPS. They allow Tomcat to see the
|
| 327 | SSL attributes of the connections between the client and the proxy rather
|
| 328 | than the proxy and Tomcat. For example, the client may connect to the
|
| 329 | proxy over HTTPS but the proxy connects to Tomcat using HTTP. If it is
|
| 330 | necessary for Tomcat to be able to distinguish between secure and
|
| 331 | non-secure connections received by a proxy, the proxy must use separate
|
| 332 | connectors to pass secure and non-secure requests to Tomcat. If the
|
| 333 | proxy uses AJP then the SSL attributes of the client connection are
|
| 334 | passed via the AJP protocol and separate connectors are not needed.</p>
|
| 335 |
|
| 336 | <p>The <strong>sslEnabledProtocols</strong> attribute determines which
|
| 337 | versions of the SSL/TLS protocol are used. Since the POODLE attack in
|
| 338 | 2014, all SSL protocols are considered unsafe and a secure setting for
|
| 339 | this attribute in a standalone Tomcat setup might be
|
| 340 | <code>sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2"</code></p>
|
| 341 |
|
| 342 | <p>The <strong>ciphers</strong> attribute controls the ciphers used for
|
| 343 | SSL connections. By default, the default ciphers for the JVM will be used.
|
| 344 | This usually means that the weak export grade ciphers will be included in
|
| 345 | the list of available ciphers. Secure environments will normally want to
|
| 346 | configure a more limited set of ciphers.</p>
|
| 347 |
|
| 348 | <p>The <strong>tomcatAuthentication</strong> and
|
| 349 | <strong>tomcatAuthorization</strong> attributes are used with the
|
| 350 | AJP connectors to determine if Tomcat should handle all authentication and
|
| 351 | authorisation or if authentication should be delegated to the reverse
|
| 352 | proxy (the authenticated user name is passed to Tomcat as part of the AJP
|
| 353 | protocol) with the option for Tomcat to still perform authorization.</p>
|
| 354 |
|
| 355 | <p>The <strong>allowUnsafeLegacyRenegotiation</strong> attribute provides
|
| 356 | a workaround for
|
| 357 | <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555">
|
| 358 | CVE-2009-3555</a>, a TLS man in the middle attack. This workaround applies
|
| 359 | to the BIO connector. It is only necessary if the underlying SSL
|
| 360 | implementation is vulnerable to CVE-2009-3555. For more information on the
|
| 361 | current state of this vulnerability and the work-arounds available see the
|
| 362 | <a href="http://tomcat.apache.org/security-7.html">Tomcat 7 security
|
| 363 | page</a>.</p>
|
| 364 |
|
| 365 | <p>The <strong>requiredSecret</strong> attribute in AJP connectors
|
| 366 | configures shared secret between Tomcat and reverse proxy in front of
|
| 367 | Tomcat. It is used to prevent unauthorized connections over AJP protocol.</p>
|
| 368 | </blockquote></td></tr></table>
|
| 369 |
|
| 370 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Host"><strong>Host</strong></a></font></td></tr><tr><td><blockquote>
|
| 371 | <p>The host element controls deployment. Automatic deployment allows for
|
| 372 | simpler management but also makes it easier for an attacker to deploy a
|
| 373 | malicious application. Automatic deployment is controlled by the
|
| 374 | <strong>autoDeploy</strong> and <strong>deployOnStartup</strong>
|
| 375 | attributes. If both are <code>false</code>, only Contexts defined in
|
| 376 | server.xml will be deployed and any changes will require a Tomcat restart.
|
| 377 | </p>
|
| 378 |
|
| 379 | <p>In a hosted environment where web applications may not be trusted, set
|
| 380 | the <strong>deployXML</strong> attribute to <code>false</code> to ignore
|
| 381 | any context.xml packaged with the web application that may try to assign
|
| 382 | increased privileges to the web application. Note that if the security
|
| 383 | manager is enabled that the <strong>deployXML</strong> attribute will
|
| 384 | default to <code>false</code>.</p>
|
| 385 | </blockquote></td></tr></table>
|
| 386 |
|
| 387 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Context"><strong>Context</strong></a></font></td></tr><tr><td><blockquote>
|
| 388 | <p>This applies to <a href="config/context.html">Context</a>
|
| 389 | elements in all places where they can be defined:
|
| 390 | <code>server.xml</code> file,
|
| 391 | default <code>context.xml</code> file,
|
| 392 | per-host <code>context.xml.default</code> file,
|
| 393 | web application context file in per-host configuration directory
|
| 394 | or inside the web application.</p>
|
| 395 |
|
| 396 | <p>The <strong>crossContext</strong> attribute controls if a context is
|
| 397 | allowed to access the resources of another context. It is
|
| 398 | <code>false</code> by default and should only be changed for trusted web
|
| 399 | applications.</p>
|
| 400 |
|
| 401 | <p>The <strong>privileged</strong> attribute controls if a context is
|
| 402 | allowed to use container provided servlets like the Manager servlet. It is
|
| 403 | <code>false</code> by default and should only be changed for trusted web
|
| 404 | applications.</p>
|
| 405 |
|
| 406 | <p>The <strong>allowLinking</strong> attribute controls if a context is
|
| 407 | allowed to use linked files. If enabled and the context is undeployed, the
|
| 408 | links will be followed when deleting the context resources. To avoid this
|
| 409 | behaviour, use the <strong>aliases</strong> attribute. Changing this
|
| 410 | setting from the default of <code>false</code> on case insensitive
|
| 411 | operating systems (this includes Windows) will disable a number of
|
| 412 | security measures and allow, among other things, direct access to the
|
| 413 | WEB-INF directory.</p>
|
| 414 |
|
| 415 | <p>The <strong>sessionCookiePathUsesTrailingSlash</strong> can be used to
|
| 416 | work around a bug in a number of browsers (Internet Explorer, Safari and
|
| 417 | Edge) to prevent session cookies being exposed across applications when
|
| 418 | applications share a common path prefix. However, enabling this option
|
| 419 | can create problems for applications with Servlets mapped to
|
| 420 | <code>/*</code>. It should also be noted the RFC6265 section 8.5 makes it
|
| 421 | clear that different paths should not be considered sufficient to isolate
|
| 422 | cookies from other applications.</p>
|
| 423 | </blockquote></td></tr></table>
|
| 424 |
|
| 425 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Valves"><strong>Valves</strong></a></font></td></tr><tr><td><blockquote>
|
| 426 | <p>It is strongly recommended that an AccessLogValve is configured. The
|
| 427 | default Tomcat configuration includes an AccessLogValve. These are
|
| 428 | normally configured per host but may also be configured per engine or per
|
| 429 | context as required.</p>
|
| 430 |
|
| 431 | <p>Any administrative application should be protected by a
|
| 432 | RemoteAddrValve. (Note that this Valve is also available as a Filter.)
|
| 433 | The <strong>allow</strong> attribute should be used to limit access to a
|
| 434 | set of known trusted hosts.</p>
|
| 435 |
|
| 436 | <p>The default ErrorReportValve includes the Tomcat version number in the
|
| 437 | response sent to clients. To avoid this, custom error handling can be
|
| 438 | configured within each web application. Alternatively, you can explicitly
|
| 439 | configure an <a href="config/valve.html">ErrorReportValve</a> and set its
|
| 440 | <strong>showServerInfo</strong> attribute to <code>false</code>.
|
| 441 | Alternatively, the version number can be changed by creating the file
|
| 442 | CATALINA_BASE/lib/org/apache/catalina/util/ServerInfo.properties with
|
| 443 | content as follows:</p>
|
| 444 | <div class="codeBox"><pre><code>
|
| 445 | server.info=Apache Tomcat/7.0.x
|
| 446 | </code></pre></div>
|
| 447 | <p>Modify the values as required. Note that this will also change the version
|
| 448 | number reported in some of the management tools and may make it harder to
|
| 449 | determine the real version installed. The CATALINA_HOME/bin/version.bat|sh
|
| 450 | script will still report the version number.</p>
|
| 451 |
|
| 452 | <p>The default ErrorReportValve can display stack traces and/or JSP
|
| 453 | source code to clients when an error occurs. To avoid this, custom error
|
| 454 | handling can be configured within each web application. Alternatively, you
|
| 455 | can explicitly configure an <a href="config/valve.html">ErrorReportValve</a>
|
| 456 | and set its <strong>showReport</strong> attribute to <code>false</code>.</p>
|
| 457 | </blockquote></td></tr></table>
|
| 458 |
|
| 459 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Realms"><strong>Realms</strong></a></font></td></tr><tr><td><blockquote>
|
| 460 | <p>The MemoryRealm is not intended for production use as any changes to
|
| 461 | tomcat-users.xml require a restart of Tomcat to take effect.</p>
|
| 462 |
|
| 463 | <p>The JDBCRealm is not recommended for production use as it is single
|
| 464 | threaded for all authentication and authorization options. Use the
|
| 465 | DataSourceRealm instead.</p>
|
| 466 |
|
| 467 | <p>The UserDatabaseRealm is not intended for large-scale installations. It
|
| 468 | is intended for small-scale, relatively static environments.</p>
|
| 469 |
|
| 470 | <p>The JAASRealm is not widely used and therefore the code is not as
|
| 471 | mature as the other realms. Additional testing is recommended before using
|
| 472 | this realm.</p>
|
| 473 |
|
| 474 | <p>By default, the realms do not implement any form of account lock-out.
|
| 475 | This means that brute force attacks can be successful. To prevent a brute
|
| 476 | force attack, the chosen realm should be wrapped in a LockOutRealm.</p>
|
| 477 | </blockquote></td></tr></table>
|
| 478 |
|
| 479 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="server.xml/Manager"><strong>Manager</strong></a></font></td></tr><tr><td><blockquote>
|
| 480 | <p>The manager component is used to generate session IDs.</p>
|
| 481 |
|
| 482 | <p>The class used to generate random session IDs may be changed with
|
| 483 | the <strong>randomClass</strong> attribute.</p>
|
| 484 |
|
| 485 | <p>The length of the session ID may be changed with the
|
| 486 | <strong>sessionIdLength</strong> attribute.</p>
|
| 487 | </blockquote></td></tr></table>
|
| 488 |
|
| 489 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Cluster"><strong>Cluster</strong></a></font></td></tr><tr><td><blockquote>
|
| 490 | <p>The cluster implementation is written on the basis that a secure,
|
| 491 | trusted network is used for all of the cluster related network traffic. It
|
| 492 | is not safe to run a cluster on a insecure, untrusted network.</p>
|
| 493 | </blockquote></td></tr></table>
|
| 494 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="System Properties"><!--()--></a><a name="System_Properties"><strong>System Properties</strong></a></font></td></tr><tr><td><blockquote>
|
| 495 | <p>Setting <strong>org.apache.catalina.connector.RECYCLE_FACADES</strong>
|
| 496 | system property to <code>true</code> will cause a new facade object to be
|
| 497 | created for each request. This reduces the chances of a bug in an
|
| 498 | application exposing data from one request to another.</p>
|
| 499 |
|
| 500 | <p>The <strong>
|
| 501 | org.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH</strong> and
|
| 502 | <strong>org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH</strong>
|
| 503 | system properties allow non-standard parsing of the request URI. Using
|
| 504 | these options when behind a reverse proxy may enable an attacker to bypass
|
| 505 | any security constraints enforced by the proxy.</p>
|
| 506 |
|
| 507 | <p>The <strong>
|
| 508 | org.apache.catalina.connector.Response.ENFORCE_ENCODING_IN_GET_WRITER
|
| 509 | </strong> system property has security implications if disabled. Many user
|
| 510 | agents, in breach of RFC2616, try to guess the character encoding of text
|
| 511 | media types when the specification-mandated default of ISO-8859-1 should be
|
| 512 | used. Some browsers will interpret as UTF-7 a response containing characters
|
| 513 | that are safe for ISO-8859-1 but trigger an XSS vulnerability if interpreted
|
| 514 | as UTF-7.</p>
|
| 515 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="web.xml"><strong>web.xml</strong></a></font></td></tr><tr><td><blockquote>
|
| 516 | <p>This applies to the default <code>conf/web.xml</code> file and
|
| 517 | <code>WEB-INF/web.xml</code> files in web applications if they define
|
| 518 | the components mentioned here.</p>
|
| 519 |
|
| 520 | <p>The <a href="default-servlet.html">DefaultServlet</a> is configured
|
| 521 | with <strong>readonly</strong> set to
|
| 522 | <code>true</code>. Changing this to <code>false</code> allows clients to
|
| 523 | delete or modify static resources on the server and to upload new
|
| 524 | resources. This should not normally be changed without requiring
|
| 525 | authentication.</p>
|
| 526 |
|
| 527 | <p>The DefaultServlet is configured with <strong>listings</strong> set to
|
| 528 | <code>false</code>. This isn't because allowing directory listings is
|
| 529 | considered unsafe but because generating listings of directories with
|
| 530 | thousands of files can consume significant CPU leading to a DOS attack.
|
| 531 | </p>
|
| 532 |
|
| 533 | <p>The DefaultServlet is configured with <strong>showServerInfo</strong>
|
| 534 | set to <code>true</code>. When the directory listings is enabled the Tomcat
|
| 535 | version number is included in the response sent to clients. To avoid this,
|
| 536 | you can explicitly configure a DefaultServlet and set its
|
| 537 | <strong>showServerInfo</strong> attribute to false.
|
| 538 | Alternatively, the version number can be changed by creating the file
|
| 539 | CATALINA_BASE/lib/org/apache/catalina/util/ServerInfo.properties with
|
| 540 | content as follows:</p>
|
| 541 | <div class="codeBox"><pre><code>server.info=Apache Tomcat/7.0.x</code></pre></div>
|
| 542 | <p>Modify the values as required. Note that this will also change the version
|
| 543 | number reported in some of the management tools and may make it harder to
|
| 544 | determine the real version installed. The CATALINA_HOME/bin/version.bat|sh
|
| 545 | script will still report the version number.
|
| 546 | </p>
|
| 547 |
|
| 548 | <p>The CGI Servlet is disabled by default. If enabled, the debug
|
| 549 | initialisation parameter should not be set to <code>10</code> or higher on a
|
| 550 | production system because the debug page is not secure.</p>
|
| 551 |
|
| 552 | <p><a href="config/filter.html">FailedRequestFilter</a>
|
| 553 | can be configured and used to reject requests that had errors during
|
| 554 | request parameter parsing. Without the filter the default behaviour is
|
| 555 | to ignore invalid or excessive parameters.</p>
|
| 556 |
|
| 557 | <p><a href="config/filter.html">HttpHeaderSecurityFilter</a> can be
|
| 558 | used to add headers to responses to improve security. If clients access
|
| 559 | Tomcat directly, then you probably want to enable this filter and all the
|
| 560 | headers it sets unless your application is already setting them. If Tomcat
|
| 561 | is accessed via a reverse proxy, then the configuration of this filter needs
|
| 562 | to be co-ordinated with any headers that the reverse proxy sets.</p>
|
| 563 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="General"><strong>General</strong></a></font></td></tr><tr><td><blockquote>
|
| 564 | <p>BASIC and FORM authentication pass user names and passwords in clear
|
| 565 | text. Web applications using these authentication mechanisms with clients
|
| 566 | connecting over untrusted networks should use SSL.</p>
|
| 567 |
|
| 568 | <p>The session cookie for a session with an authenticated user are nearly
|
| 569 | as useful as the user's password to an attacker and in nearly all
|
| 570 | circumstances should be afforded the same level of protection as the
|
| 571 | password itself. This usually means authenticating over SSL and continuing
|
| 572 | to use SSL until the session ends.</p>
|
| 573 | </blockquote></td></tr></table></td></tr><tr class="noPrint"><td width="20%" valign="top" nowrap class="noPrint"></td><td width="80%" valign="top" align="left"><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="comments_section" id="comments_section"><strong>Comments</strong></a></font></td></tr><tr><td><blockquote><p class="notice"><strong>Notice: </strong>This comments section collects your suggestions
|
| 574 | on improving documentation for Apache Tomcat.<br><br>
|
| 575 | If you have trouble and need help, read
|
| 576 | <a href="http://tomcat.apache.org/findhelp.html">Find Help</a> page
|
| 577 | and ask your question on the tomcat-users
|
| 578 | <a href="http://tomcat.apache.org/lists.html">mailing list</a>.
|
| 579 | Do not ask such questions here. This is not a Q&A section.<br><br>
|
| 580 | The Apache Comments System is explained <a href="./comments.html">here</a>.
|
| 581 | Comments may be removed by our moderators if they are either
|
| 582 | implemented or considered invalid/off-topic.</p><script type="text/javascript"><!--//--><![CDATA[//><!--
|
| 583 | var comments_shortname = 'tomcat';
|
| 584 | var comments_identifier = 'http://tomcat.apache.org/tomcat-7.0-doc/security-howto.html';
|
| 585 | (function(w, d) {
|
| 586 | if (w.location.hostname.toLowerCase() == "tomcat.apache.org") {
|
| 587 | d.write('<div id="comments_thread"><\/div>');
|
| 588 | var s = d.createElement('script');
|
| 589 | s.type = 'text/javascript';
|
| 590 | s.async = true;
|
| 591 | s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
|
| 592 | (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
|
| 593 | }
|
| 594 | else {
|
| 595 | d.write('<div id="comments_thread"><strong>Comments are disabled for this page at the moment.<\/strong><\/div>');
|
| 596 | }
|
| 597 | })(window, document);
|
| 598 | //--><!]]></script></blockquote></td></tr></table></td></tr><!--FOOTER SEPARATOR--><tr><td colspan="2"><hr noshade size="1"></td></tr><!--PAGE FOOTER--><tr><td colspan="2"><div align="center"><font color="#525D76" size="-1"><em>
|
| 599 | Copyright © 1999-2017, Apache Software Foundation
|
| 600 | </em></font></div></td></tr></table></body></html> |