Hiding Apache Tomcat Version Number from Error Pages in Siteminder Access Gateway

Products

• SITEMINDER

Issue/Introduction

Due to security issues, there is a need to hide the Apache Tomcat version from Tomcat error page as indicated below 

Environment

Any Siteminder Access Gateway  supported release 

Resolution

There are couple of ways to hide the version, one being through redirecting to a custom error pages altogether, please see below links 

https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/siteminder/12-8/configuring/access-gateway-configuration/configure-the-custom-error-pages-settings.html

https://knowledge.broadcom.com/external/article?articleNumber=265999

https://knowledge.broadcom.com/external/article?articleNumber=272532

 

Or if you do not want to enable the Custom Error pages in AG , you can try the following 

Please follow the below Steps to hide the Apache Tomcat version from the Error pages 

1. Go to AG Server and navigate to the accessgateway_home/tomcat/lib directory
2. Create the following path under the lib subdirectory - org/apache/catalina/util (Example: accessgateway_home/lib/org/apache/catalina/util)
3. Create a  file with the name 'ServerInfo.properties' in the UTIL folder
4. Edit the file and type the message you want to appear. For example: server.info=Apache Tomcat
5. Save changes
6. Restart the Access Gateway service
7. Delete web browser cache

Now when an Apache Tomcat page is viewed, the version information is replaced with the text entered in the ServerInfo.properties file created above.