AccessLogValve must be configured per each virtual host.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-222938 | TCAT-AS-000180 | SV-222938r960882_rule | CCI-000130 | medium |
| Description | ||||
| Application servers utilize role-based access controls in order to specify the individuals who are allowed to configure application component loggable events. The application server must be configured to select which personnel are assigned the role of selecting which loggable events are to be logged. Satisfies: SRG-APP-000090-AS-000051, SRG-APP-000095-AS-000056, SRG-APP-000100-AS-000063, SRG-APP-000101-AS-000072, SRG-APP-000503-AS-000228, SRG-APP-000505-AS-000230, SRG-APP-000506-AS-000231 | ||||
| STIG | Date | |||
| Apache Tomcat Application Server 9 Security Technical Implementation Guide | 2025-02-11 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
AU-3
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.3.1
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.3.2
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000130
1.00
- DISA · 3 · disa_xccdf · related
Details
Check Text (C-222938r960882_chk)
As an elevated user on the Tomcat server:
Edit the $CATALINA_BASE/conf/server.xml file.
Review for all <Host> elements.
If a <Valve className="org.apache.catalina.valves.AccessLogValve" .../> element is not nested within each <Host> element, this is a finding.
EXAMPLE:
<Host name="localhost" appBase="webapps"
unpackWARs="true" autoDeploy="false">
...
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
prefix="localhost_access_log" suffix=".txt"
pattern="%h %l %t %u "%r" %s %b" />
...
</Host>
Fix Text (F-24599r426259_fix)
As a privileged user on the Tomcat server:
Edit the $CATALINA_BASE/conf/server.xml file.
Create a <Valve> element that is nested beneath the <Host> element containing an AccessLogValve.
EXAMPLE:
<Host name="localhost" appBase="webapps"
unpackWARs="true" autoDeploy="false">
...
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
prefix="localhost_access_log" suffix=".txt"
pattern="%h %l %t %u "%r" %s %b" />
...
</Host>
Restart the Tomcat server:
sudo systemctl restart tomcat
sudo systemctl daemon-reload