4.2 Restrict access to $CATALINA_BASE


$CATALINA_BASE is the environment variable that specifies the base directory which most relative paths are resolved. $CATALINA_BASE is usually used when there are multiple instances of Tomcat running. It is important to protect access to this in order to protect the Tomcat-related binaries and libraries from unauthorized modification. It is recommended that the ownership of $CATALINA_BASE be tomcat_admin:tomcat. It is also recommended that the permissions on $CATALINA_BASE prevent read, write, and execute for the world (o-rwx) and prevent write access to the group (g-w).

Note: Nessus is configured to use the CATALINA_HOME variable value as the location of $CATALINA_BASE. If you are running multiple instances of Tomcat on this host, it may be necessary to run multiple scans in order to confirm proper configuration.


Perform the following to establish the recommended state:
1. Set the ownership of the $CATALINA_BASE to tomcat_admin:tomcat.
2. Remove read, write, and execute permissions for the world
3. Remove write permissions for the group.
# chown tomcat_admin.tomcat $CATALINA_BASE
# chmod g-w,o-rwx $CATALINA_BASE

See Also


Item Details


References: 800-53|AC-6

Plugin: Unix

Control ID: 41a2bc2641c096015b461abc44373a757b8670341eddab0c0d16eb4690dc26da