TCAT-AS-001270 - $CATALINA_BASE/temp folder permissions must be set to 750.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Tomcat's file permissions must be restricted. The standard configuration is to have all Tomcat files owned by root with the group Tomcat. While root has read/write privileges, tomcat group only has read and world has no permissions. The exceptions are the logs, temp and work directory that are owned by the Tomcat user rather than root. This means that even if an attacker compromises the Tomcat process, they cannot change the Tomcat configuration, deploy new web applications, or modify existing web applications. The Tomcat process runs with a umask of 0027 to maintain these permissions.

If operational needs require application administrators to be able to change application configurations, the group permissions can be modified to allow specific application admins the access they require with an ISSM risk acceptance. Ownership may not change.

Solution

If operational/application requirements specify different file permissions, obtain ISSM risk acceptance and set permissions according to risk acceptance.

Run the following commands on the Tomcat server:

sudo find $CATALINA_BASE/temp -follow -maxdepth 0 -type d -print0 | sudo xargs chmod 750 $CATALINA_BASE/temp

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apache_Tomcat_Application_Server_9_V2R4_STIG.zip

Item Details

References: CAT|III, CCI|CCI-001813, Rule-ID|SV-222990r754845_rule, STIG-ID|TCAT-AS-001270, STIG-Legacy|SV-111503, STIG-Legacy|V-102563, Vuln-ID|V-222990

Plugin: Unix

Control ID: 82db08ad52b36a7ed1c97b09a003fc50668ef64edaf10c43e9ca8fe623abecdc