This Confluence has been LDAP enabled, if you are an ASF Committer, please use your LDAP Credentials to login. Any problems file an INFRA jira ticket please.

Page tree

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Preface

This FAQ section provides help with some security-related issues. If you hear of a vulnerability or its exploitation, please see the security page.

The Record

There have been no public cases of damage done to a company, organization, or individual due to a Tomcat security issue. There have been no documented cases of data loss or application crashes caused by an intruder. While there have been numerous analyses conducted on Tomcat, partially because this is easy to do with Tomcat's source code openly available, there have been only theoretical vulnerabilities found. All of those were addressed even though there were no documented cases of actual exploitation of these vulnerabilities.

...

Please see "Security considerations" pages in Tomcat documentation (linked below) for a reference on how access to Management Applications in Tomcat should be secured.

  • There have been several reports of compromises via vulnerabilities in 3-rd party web applications deployed on Tomcat. E.g. vulnerabilities in Apache Struts framework were a popular attack target several times in years 2013-2017. E.g. Equifax breach in year 2017. It is unknown whether Equifax has run their application on Tomcat, but there have been a number of similar compromise reports from Tomcat users. Those are not caused by a vulnerability in Tomcat.

Role of Customization

We believe, and the evidence suggests, that Tomcat is more than secure enough for most use-cases. However, like all other components of Tomcat, you can customize any and all of the relevant parts of the server to achieve even higher security. For example, the session manager implementation is pluggable, and even the default implementation has support for pluggable random number generators. If you have a special need that you feel is not met by Tomcat out of the box, consider these customization options. At the same time, please bring up your requirements on the user mailing list, where we'll be glad to discuss it and assist in your approach/design/implementation as needed.

It is also possible to configure Tomcat insecurely. Please see "Security considerations" pages in Tomcat documentation (linked below) for the list of security-sensitive options.

Questions

  1. How do I use OpenSSL to set up my own Certificate Authority (CA)?
  2. Oh no! Port 8005 is available for anyone on localhost to shutdown my tomcat!
  3. What about Tomcat running as root?
  4. How do I force all my pages to run under HTTPS?
  5. What is the default login for the manager and admin app?
  6. How do I restrict access by ip address or remote host?
  7. How do I use jsvc/procrun to run Tomcat on port 80 securely?
  8. Has Tomcat's security been independently analyzed or audited?
  9. How do I change the Server header in the response?
  10. Why are passwords in plain text?
  11. How can I restrict the list of ciphers used for HTTPS?
  12. Is Tomcat vulnerable to Heartbleed bug?
  13. Is Tomcat vulnerable to POODLE attack?
  14. Which cipher suites should I use?

Answers

Anchor
Q1
Q1

How do I use OpenSSL to set up my own Certificate Authority (CA)?

Using OpenSSL to set up your own CA.

Anchor
Q2
Q2

Oh no! Port 8005 is available for anyone on localhost to shutdown my tomcat!

See these 2 discussions.

Anchor
Q3
Q3

What about Tomcat running as root?

See these threads:

Anchor
Q4
Q4

How do I force all my pages to run under HTTPS?

Use security-constraint in web.xml.

Anchor
Q5
Q5

What is the default login for the manager and admin app?

The admin and manager application do not provide a default login. Doing so would be a security flaw. You need to edit $CATALINA_HOME/conf/tomcat-users.xml file if you are using the default install. See Configuring Manager Application Access for details.

...

There was once a bug that blindly clicking-trough the Windows installer configured a manager user with blank password (CVE-2009-3548). This was fixed by April 2010 (Tomcat 5.5.29, 6.0.24 and later are safe).

Anchor
Q6
Q6

How do I restrict access by ip address or remote host?

By using the RemoteHostValve or RemoteAddrValve. Warning, these valves rely on accurate incoming ip addresses or hostnames. So they can fall victim to spoofing! See also RemoteIpValve. Valve Reference Link

Anchor
Q7
Q7

How do I use jsvc/procrun to run Tomcat on port 80 securely?

Fairly easily (wink) See the Setup page in the docs for your tomcat release, and read this mailing list post for a complete setup example with permissions etc.

Anchor
Q8
Q8

Has Tomcat's security been independently analyzed or audited?

Yes, by numerous organizations and individuals, many times. Try this Google search and you'll see many references, guides, and analyses.

Anchor
Q9
Q9

How do I change the Server header in the response?

In server.xml - add a "server" attribute to the Connector element. http://tomcat.apache.org/tomcat-7.0-doc/config/http.html

Anchor
Q10
Q10

Why are passwords in plain text?

We have a page dedicated to this topic. FAQ/Password

Anchor
Q11
Q11

How can I restrict the list of ciphers used for HTTPS?

See HowTo SSLCiphers.

Anchor
Q12
Q12

Is Tomcat vulnerable to Heartbleed bug?

See Security/Heartbleed.

Anchor
Q13
Q13

Is Tomcat vulnerable to POODLE attack?

See Security/POODLE.

Anchor
Q14
Q14

Which cipher suites should I use?

See Security/Ciphers.