Detections
Analytics
TCAT-AS-000250 - Remote hostname must be logged.
Information
The access logfile format is defined within a Valve that implements the org.apache.catalina.valves.AccessLogValve interface within the /opt/tomcat/server.xml configuration file: The %h pattern code is included in the pattern element and logs the remote hostname. Including the hostname pattern in the log configuration provides useful information about the connecting host that is critical for troubleshooting and forensic investigations.Solution
As a privileged user on the Tomcat server:Edit the $CATALINA_BASE/conf/server.xml file.
Modify the <Valve> element(s) nested within the <Host> element(s).
Change the AccessLogValve setting to include %h in the pattern= statement.
EXAMPLE:
<Host name='localhost' appBase='webapps'
unpackWARs='true' autoDeploy='false'>
...
<Valve className='org.apache.catalina.valves.AccessLogValve' directory='logs'
prefix='localhost_access_log' suffix='.txt'
pattern='%h %l %t %u "%r" %s %b' />
...
</Host>
Restart the Tomcat server:
sudo systemctl restart tomcat
sudo systemctl daemon-reload
See Also
Item Details
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-3, CAT|II, CCI|CCI-000132, Rule-ID|SV-222940r615938_rule, STIG-ID|TCAT-AS-000250, STIG-Legacy|SV-111409, STIG-Legacy|V-102463, Vuln-ID|V-222940
Plugin: Unix
Control ID: 261c901988fcb39680a3a51390594f13a1257833191eac319b93c8a4d0e8f728