0

My project is using an Embedded Tomcat with the Java Springboot application, and the customer requires the Tomcat to comply with a hardening guideline for security purpose, which contains follows, for example:

  1. Remove the Default Web Applications in the Tomcat
  • Balancer(in CATALINA_HOME/webapps) - Remove
  • jsp-examples(in CATALINA_HOME/webapps) - Remove
  • ROOT(in CATALINA_HOME/webapps) - Remove
  • sevlets-examples(in CATALINA_HOME/webapps) - Remove
  • tomcat-docs(in CATALINA_HOME/webapps) - Remove
  • Webdav(in CATALINA_HOME/webapps) - Remove
  • Host-manager(in CATALINA_HOME/servers/webapps) - Remove if not in use
  • Manager and host-manager XML files(in CATALINA_HOME/conf/Catalina/localhost) - Remove if not in use
  1. Remove unused Connectors
  • HTTP/1.1 port 8080
  • SSL HTTP/1.1 port 8443
  • JK/JK2 AJP 1.3 port 8009
  • Proxied HTTP/1.1 port 8082

Where can I find the configurations in the Embedded Tomcat server to achieve the compliance? Any ideas where I can start from?

Please let me know if you need any additional information. Thanks in advance! Just to add on, below is how we included the embedded tomcat in the java application pom file:

 <dependency> 
   <groupId>org.springframework.boot</groupId>
   <artifactId>spring-boot-starter-web</artifactId>
 </dependency>

https://spring.io/blog/2014/03/07/deploying-spring-boot-applications

moon.cricket
  • 1
  • 1
  • 2
    None of those are in there, so you already comply. – M. Deinum Jun 23 '21 at 15:01
  • Hi @M.Deinum, thanks for the reply! so this means the embedded tomcat will not create any default or unused application web servers& connectors, right? Btw, if you have time, could you please help me take a look at another case? Much appreciate it! https://stackoverflow.com/questions/68103825/how-to-run-embedded-tomcat-as-unprivileged-user-restrict-access-to-tomcat-mana – moon.cricket Jun 23 '21 at 16:36
  • It won't as those are only part of the regular tomcat installation not the embedded tomcat. – M. Deinum Jun 23 '21 at 17:15
  • The fact that you ask those questions means you lack understanding what an embedded tomcat is and how it works. Those questions don't apply to an embedded tomcat instance **only** to a regular tomcat installation. – M. Deinum Jun 23 '21 at 17:15
  • Hi @M.Deinum, yes indeed, I need to more research on it. Thank you for the help! – moon.cricket Jun 24 '21 at 03:03

0 Answers0