Item Search

NameAudit NamePluginCategory
2.4 Disable X-Powered-By HTTP Header and Rename the Server Value for all ConnectorsCIS Apache Tomcat 10 L2 v1.1.0Unix

SYSTEM AND INFORMATION INTEGRITY

2.4 Disable X-Powered-By HTTP Header and Rename the Server Value for all ConnectorsCIS Apache Tomcat 8 L2 v1.1.0 MiddlewareUnix

CONFIGURATION MANAGEMENT

2.4 Disable X-Powered-By HTTP Header and Rename the Server Value for all ConnectorsCIS Apache Tomcat 9 L2 v1.2.0Unix

CONFIGURATION MANAGEMENT

2.4 Disable X-Powered-By HTTP Header and Rename the Server Value for all ConnectorsCIS Apache Tomcat 10.1 v1.1.0 L2Unix

CONFIGURATION MANAGEMENT

2.4 Disable X-Powered-By HTTP Header and Rename the Server Value for all ConnectorsCIS Apache Tomcat 9 L2 v1.2.0 MiddlewareUnix

CONFIGURATION MANAGEMENT

2.4 Disable X-Powered-By HTTP Header and Rename the Server Value for all ConnectorsCIS Apache Tomcat 11 v1.0.0 L2Unix

CONFIGURATION MANAGEMENT

2.4 Disable X-Powered-By HTTP Header and Rename the Server Value for all ConnectorsCIS Apache Tomcat 7 L2 v1.1.0Unix

SYSTEM AND COMMUNICATIONS PROTECTION

2.4 Disable X-Powered-By HTTP Header and Rename the Server Value for all ConnectorsCIS Apache Tomcat 10 L2 v1.1.0 MiddlewareUnix

SYSTEM AND INFORMATION INTEGRITY

2.4 Disable X-Powered-By HTTP Header and Rename the Server Value for all ConnectorsCIS Apache Tomcat 8 L2 v1.1.0Unix

CONFIGURATION MANAGEMENT

DISA_IIS_8.5_Web_Server_v2r7.audit from DISA Microsoft IIS 8.5 Server v2r7 STIGDISA IIS 8.5 Server v2r7Windows
DISA_STIG_Apache_Server-2.4_Unix_v3r2_Middleware.audit from DISA Apache Server 2.4 UNIX Server v3r2 STIGDISA STIG Apache Server 2.4 Unix Server v3r2 MiddlewareUnix
DISA_STIG_Apache_Server-2.4_Unix_v3r2.audit from DISA Apache Server 2.4 UNIX Server v3r2 STIGDISA STIG Apache Server 2.4 Unix Server v3r2Unix
DISA_STIG_Apache_Server-2.4_Windows_v2r3.audit from DISA Apache Server 2.4 Windows Server v2r3 STIGDISA STIG Apache Server 2.4 Windows Server v2r3Windows
DISA_STIG_Apache_Server-2.4_Windows_v3r3.audit from DISA Apache Server 2.4 Windows Server v3r3 STIGDISA STIG Apache Server 2.4 Windows Server v3r3Windows
DISA_STIG_Apache_Site-2.4_Unix_v2r6_Middleware.audit from DISA Apache Server 2.4 UNIX Site v2r6 STIGDISA STIG Apache Server 2.4 Unix Site v2r6 MiddlewareUnix
DISA_STIG_Apache_Tomcat_Application_Server_9_v3r2_Middleware.audit from DISA Apache Tomcat Application Server 9 v3r2 STIGDISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix
DISA_STIG_Microsoft_Windows_2012_Server_DNS_v2r7.audit from DISA Microsoft Windows 2012 Server Domain Name System v2r7 STIGDISA Microsoft Windows 2012 Server DNS STIG v2r7Windows
DISA_STIG_Oracle_Linux_6_v2r7.audit from DISA Oracle Linux 6 v2r7 STIGDISA STIG Oracle Linux 6 v2r7Unix
TCAT-AS-000010 - The number of allowed simultaneous sessions to the manager application must be limited.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

ACCESS CONTROL

TCAT-AS-000020 - Secured connectors must be configured to use strong encryption ciphers.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

ACCESS CONTROL

TCAT-AS-000040 - TLS 1.2 must be used on secured HTTP connectors.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

TCAT-AS-000060 - Default password for keystore must be changed.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION

TCAT-AS-000080 - Cookies must have http-only flag set.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

ACCESS CONTROL

TCAT-AS-000110 - The Java Security Manager must be enabled.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

ACCESS CONTROL

TCAT-AS-000180 - AccessLogValve must be configured per each virtual host.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

AUDIT AND ACCOUNTABILITY

TCAT-AS-000240 - Date and time of events must be logged.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

AUDIT AND ACCOUNTABILITY

TCAT-AS-000361 - Files in the $CATALINA_BASE/logs/ folder must have their permissions set to 640.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

AUDIT AND ACCOUNTABILITY

TCAT-AS-000370 - Files in the $CATALINA_BASE/conf/ folder must have their permissions set to 640.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT

TCAT-AS-000520 - DefaultServlet directory listings parameter must be disabled.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

CONFIGURATION MANAGEMENT

TCAT-AS-000550 - xpoweredBy attribute must be disabled.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

CONFIGURATION MANAGEMENT

TCAT-AS-000690 - LDAP authentication must be secured.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

IDENTIFICATION AND AUTHENTICATION

TCAT-AS-000700 - DOD root CA certificates must be installed in Tomcat trust store.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

IDENTIFICATION AND AUTHENTICATION

TCAT-AS-000780 - Access to JMX management interface must be restricted.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

SYSTEM AND COMMUNICATIONS PROTECTION

TCAT-AS-000860 - Clusters must operate on a trusted network.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

SYSTEM AND COMMUNICATIONS PROTECTION

TCAT-AS-000930 - Default error pages for manager application must be customized.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

SYSTEM AND INFORMATION INTEGRITY

TCAT-AS-000970 - Idle timeout for the management application must be set to 10 minutes.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION

TCAT-AS-001040 - LockOutRealms lockOutTime attribute must be set to 600 seconds (10 minutes) for admin users.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

ACCESS CONTROL

TCAT-AS-001050 - Tomcat user account must be set to nologin.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

ACCESS CONTROL

TCAT-AS-001200 - $CATALINA_HOME folder must be owned by the root user, group tomcat.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

CONFIGURATION MANAGEMENT

TCAT-AS-001220 - $CATALINA_BASE/conf/ folder must be owned by root, group tomcat.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

CONFIGURATION MANAGEMENT

TCAT-AS-001280 - $CATALINA_BASE/work/ folder must be owned by tomcat user, group tomcat.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

CONFIGURATION MANAGEMENT

TCAT-AS-001320 - Multifactor certificate-based tokens (CAC) must be used when accessing the management interface.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

IDENTIFICATION AND AUTHENTICATION

TCAT-AS-001460 - The application server, when categorized as a high availability system within RMF, must be in a high-availability (HA) cluster.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

SYSTEM AND COMMUNICATIONS PROTECTION

TCAT-AS-001470 - Tomcat server must be patched for security vulnerabilities.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY

TCAT-AS-001590 - Changes to $CATALINA_HOME/bin/ folder must be logged.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

AUDIT AND ACCOUNTABILITY

TCAT-AS-001591 - Changes to $CATALINA_BASE/conf/ folder must be logged.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

AUDIT AND ACCOUNTABILITY

TCAT-AS-001660 - STRICT_SERVLET_COMPLIANCE must be set to true.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

CONFIGURATION MANAGEMENT

TCAT-AS-001680 - ALLOW_BACKSLASH must be set to false.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

CONFIGURATION MANAGEMENT

TCAT-AS-001700 - Tomcat users in a management role must be approved by the ISSO.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

CONFIGURATION MANAGEMENT

TCAT-AS-001720 - Connectors must be approved by the ISSO.DISA STIG Apache Tomcat Application Server 9 v3r2 MiddlewareUnix

CONFIGURATION MANAGEMENT