Detections
Analytics

1.1 Remove extraneous files and directories - @CATALINA_HOME@/webapps/docs

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The installation may provide example applications, documentation, and other directories which may not serve a production use.

Rationale:

Removing sample resources is a defense in depth measure that reduces potential exposures introduced by these resources.

Solution

Perform the following to remove extraneous resources:

$ rm -rf $CATALINA_HOME/webapps/docs
$CATALINA_HOME/webapps/examples
$CATALINA_HOME/webapps/ROOT

If the Manager and HOST-Manager application are not utilized, also remove the following resources:

$ rm -rf $CATALINA_HOME/webapps/host-manager
$CATALINA_HOME/webapps/manager

Default Value:

docs, examples, ROOT, manager and host-manager are default web applications shipped with Tomcat.

References:

https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications/General

See Also

https://workbench.cisecurity.org/files/2509

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7, CSCv6|9.1

Plugin: Unix

Control ID: b872788e0321b6ae8c85dcf6a00ff5cecf266873db5898eecd1471c217f9244a