Detections
Analytics

TCAT-AS-001050 - Tomcat user account must be set to nologin.

Information

When installing Tomcat, a user account is created on the OS. This account is used in order for Tomcat to be able to operate on the OS but does not require the ability to actually log in to the system. Therefore when the account is created, the account must not be provided access to a login shell or other program on the system. This is done by specifying the 'nologin' parameter in the command/shell field of the passwd file.

Solution

From the Tomcat command line type the following command:

sudo usermod -s /usr/sbin/nologin tomcat

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apache_Tomcat_Application_Server_9_V3R3_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(10), CAT|II, CCI|CCI-002235, Rule-ID|SV-222983r961353_rule, STIG-ID|TCAT-AS-001050, STIG-Legacy|SV-111489, STIG-Legacy|V-102549, Vuln-ID|V-222983

Plugin: Unix

Control ID: e37cecf3935d57b0700f98a89fb08daf4143520d5d33bc2d52ed0efe1eea4f97