'TCAT-AS-000600 - Tomcat management applications must use LDAP realm authentication.' (Vuln ID: V-222962)

Products

• CA Spectrum

Issue/Introduction

Identify the server IP that is providing LDAP services and configure the Tomcat user roles schema within LDAP. Refer to the manager and host-manager web.xml files for application specific role information that can be used for setting up the roles for those applications. The default location for these files is: $CATALINA_BASE/webapps/<AppName>/WEB-INF/web.xml

From the Tomcat server console as a privileged user, edit the $CATALINA_BASE/conf/server.xml file.

Locate the <Realm> element in the server.xml file, add a nested <Realm> element using the JNDIRealm className and configure the associated LDAP settings as per the LDAP server connection requirements.

EXAMPLE:
This is for illustration purposes only. Modify the LDAP settings on a case-by-case basis as per the individual LDAP server and schema.

<Realm   className="org.apache.catalina.realm.JNDIRealm"
     connectionURL="ldaps://localhost:686"
       userPattern="uid={0},ou=people,dc=myunit,dc=com"
          roleBase="ou=groups,dc=myunit,dc=com"
          roleName="cn"
        roleSearch="(uniqueMember={0})"

 

Using the local user store on a Tomcat installation does not meet a multitude of security control requirements related to user account management. To address this risk, Tomcat must be configured to utilize an LDAP or Active Directory installation that provides a centralized user account store that is configured to meet standard DoD user account management requirements. JNDIRealm is an implementation of the Tomcat Realm interface that looks up users in an LDAP directory server accessed by a JNDI provider (typically, the standard LDAP provider that is available with the JNDI API classes). The realm supports a variety of approaches to using a directory for authentication.

Environment

Release : 21.2

 

Resolution

DX Netops Spectrum does not ship the manager or host-manager applications.

Therefore this is not a finding.

 

 

Additional Information

https://www.stigviewer.com/stig/apache_tomcat_application_sever_9/2020-12-11/finding/V-222962