10.5 Rename the manager application - host-manager/manager.xml

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The manager application allows administrators to manage Tomcat remotely via a web interface. The manager application should be renamed to make it harder for attackers or automated scripts to locate.

Rationale:

By relocating the manager applications, an attacker will need to guess its location rather than simply navigate to the standard location in order to carry out an attack.

Solution

Perform the following to rename the manager application:

Rename the manager application XML file:

# mv $CATALINA_HOME/webapps/host-manager/manager.xml
$CATALINA_HOME/webapps/host-manager/<new-name>.xml

Update the docBase attribute within $CATALINA_HOME/webapps/host-manager/<new-name>.xml to $CATALINA_HOME/webapps/<new-name>

Move $CATALINA_HOME/webapps/manager to $CATALINA_HOME/webapps/<new-name>

# mv $CATALINA_HOME/webapps/manager $CATALINA_HOME/webapps/<new-name>

Default Value:

The default name of the manager application is manager and is located at:

$CATALINA_HOME/webapps/manager

See Also

https://workbench.cisecurity.org/files/4103