Tomcat hardening - Revision history

Tvi: 28 revisions imported

2021-12-10T10:55:42Z

28 revisions imported

← Older revision	Revision as of 12:55, 10 December 2021
(No difference)

2021-01-08T11:37:55Z

Secure headers (recommended)

← Older revision		Revision as of 13:37, 8 January 2021
Line 18:		Line 18:
	<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>		<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
	<async-supported>true</async-supported>		<async-supported>true</async-supported>
			<init-param>
			<param-name>antiClickJackingOption</param-name>
			<param-value>SAMEORIGIN</param-value>
			</init-param>
	</filter>		</filter>

2018-02-14T13:58:42Z

Additional security filters (optional)

← Older revision		Revision as of 15:58, 14 February 2018
Line 31:		Line 31:

	=== Additional security filters (optional) ===		=== Additional security filters (optional) ===
	* ~~Restrict usage~~ to ~~certain~~ countries		Tempus Serva comes with multiple additional security features
			* Lock user session to IP
			* Lock service to listed countries
			* Use passcode sent by SMS

	* Lock user session to IP		The filters are activated by uncommenting the code in the applications /WEB-INF/web.xml.

	* Use passcode sent by SMS		Note that the filters can be set any part of the application: login, designer, webiterface and rest.

	=== Validating your site ===		=== Validating your site ===

2018-02-14T13:55:49Z

Use passcode sent by SMS (optional)

← Older revision		Revision as of 15:55, 14 February 2018
Line 35:		Line 35:
	* Lock user session to IP		* Lock user session to IP

	~~===~~ Use passcode sent by SMS ~~(optional) ===~~		* Use passcode sent by SMS

	=== Validating your site ===		=== Validating your site ===

2018-02-14T13:55:34Z

Lock user session to IP (optional)

← Older revision		Revision as of 15:55, 14 February 2018
Line 33:		Line 33:
	* Restrict usage to certain countries		* Restrict usage to certain countries

	~~===~~ Lock user session to IP ~~(optional) ===~~		* Lock user session to IP



	=== Use passcode sent by SMS (optional) ===		=== Use passcode sent by SMS (optional) ===

2018-02-14T13:55:19Z

Restrict usage to certain countries (optional)

← Older revision		Revision as of 15:55, 14 February 2018
Line 30:		Line 30:
	The TS implemetation does not use rotating or pagespecific CRSF tokens, so if additional security is needed use the [https://www.owasp.org/index.php/Category:OWASP_CSRFGuard_Project OWASP implementation].		The TS implemetation does not use rotating or pagespecific CRSF tokens, so if additional security is needed use the [https://www.owasp.org/index.php/Category:OWASP_CSRFGuard_Project OWASP implementation].

	=== ~~Restrict usage to certain countries~~ (optional) ===		=== Additional security filters (optional) ===
			* Restrict usage to certain countries



	=== Lock user session to IP (optional) ===		=== Lock user session to IP (optional) ===

2018-02-14T13:54:23Z

CRSF filter (optional)

← Older revision		Revision as of 15:54, 14 February 2018
Line 25:		Line 25:
	</filter-mapping>		</filter-mapping>

	=== CRSF ~~filter~~ (optional) ===		=== Additional CRSF filtering (optional) ===
	The TS platform is allrady safe from CRSF attacks~~, so this filter is not strictly~~ required.		The TS platform is allrady safe from CRSF attacks. CRSF tokens are generated at login and required for all data altering transactions.

	The TS implemetation does not use rotating or pagespecific CRSF tokens, so if additional security is needed use the [https://www.owasp.org/index.php/Category:OWASP_CSRFGuard_Project OWASP implementation].		The TS implemetation does not use rotating or pagespecific CRSF tokens, so if additional security is needed use the [https://www.owasp.org/index.php/Category:OWASP_CSRFGuard_Project OWASP implementation].

			=== Restrict usage to certain countries (optional) ===




			=== Lock user session to IP (optional) ===



			=== Use passcode sent by SMS (optional) ===

	=== Validating your site ===		=== Validating your site ===

2018-02-14T13:51:53Z

CRSF filter (optional)

← Older revision		Revision as of 15:51, 14 February 2018
Line 26:		Line 26:

	=== CRSF filter (optional) ===		=== CRSF filter (optional) ===
	The TS platform is ~~mostly~~ safe from CRSF attacks, so this filter is not strictly required.		The TS platform is allrady safe from CRSF attacks, so this filter is not strictly required.

	In the ~~APPLICATION web~~.~~xml (<tomcat>\webapps\<app>\WEB_INF\web~~.~~xml) add the following sections~~		The TS implemetation does not use rotating or pagespecific CRSF tokens, so if additional security is needed use the [https://www.owasp.org/index.php/Category:OWASP_CSRFGuard_Project OWASP implementation].

	~~<filter>~~
	~~<filter-name>CsrfFilter<~~/~~filter-name>~~
	~~<filter-class>org~~.~~apache.catalina.filters~~.~~CsrfPreventionFilter</filter-class>~~
	~~<init-param>~~
	~~<param-name>entryPoints</param-name>~~
	~~<param-value>/login,/loginsso,/loginoauth,/mainpublic,/webinterface</param-value>~~
	~~</init-param>~~
	~~</filter>~~

	~~<filter-mapping>~~
	~~<filter-name>CsrfFilter</filter-name>~~
	~~<url-pattern>/*</url-pattern>~~
	~~</filter-mapping>~~

	=== Validating your site ===		=== Validating your site ===

2018-02-11T17:14:34Z

CRSF filter (optional)

← Older revision		Revision as of 19:14, 11 February 2018
Line 35:		Line 35:
	<init-param>		<init-param>
	<param-name>entryPoints</param-name>		<param-name>entryPoints</param-name>
	<param-value>/login,/loginsso,/loginoauth,/mainpublic,/webinterface~~,/login.do~~</param-value>		<param-value>/login,/loginsso,/loginoauth,/mainpublic,/webinterface</param-value>
	</init-param>		</init-param>
	</filter>		</filter>

2018-02-07T09:07:44Z

CRSF filter (optional)

← Older revision		Revision as of 11:07, 7 February 2018
Line 26:		Line 26:

	=== CRSF filter (optional) ===		=== CRSF filter (optional) ===
	The TS platform is ~~bascially~~ safe from CRSF attacks, so this filter is not strictly required.		The TS platform is mostly safe from CRSF attacks, so this filter is not strictly required.

	In the APPLICATION web.xml (<tomcat>\webapps\<app>\WEB_INF\web.xml) add the following sections		In the APPLICATION web.xml (<tomcat>\webapps\<app>\WEB_INF\web.xml) add the following sections