Parties within the DoD and Federal Government’s computing environments can obtain the applicable STIG from the Cyber Exchange website at.
The configuration steps within the STIG were designed and tested against the publicly available Tomcat product that is downloaded and installed as a distinct application server. While some of the STIG requirements could potentially be applied in some of these instances, this is a case-by-case scenario.
#Apache tomcat installer windows code#
Embedded Tomcat configurations contained within application code are not within scope of the STIG development effort. Using the Tomcat source code in their product allows vendors to quickly incorporate Java-based web application features and functions without recreating or licensing a separate application server component. Due to the availability of Tomcat source code and the open source nature of the product, Tomcat is often embedded into other products, particularly multi-tiered client server web applications.
#Apache tomcat installer windows windows#
Tomcat instances operating on the Windows operating system are also not in scope for this STIG. Applications provided with Tomcat that are used for managing the Tomcat server (e.g., the manager app) are within scope, while applications installed on the Tomcat server are not in scope. Bear in mind that the STIG was written for the management of the base Tomcat server. When applying the STIG to other Linux flavors, the SME must adapt the STIG file path information and commands to those used by the flavor of Linux being assessed. The Tomcat STIG was developed using Apache Tomcat 9 version 9.0.22 and Ubuntu’s OpenJDK 11.0.4+11 running on the Ubuntu Linux 18.04 bionic OS version. The Tomcat web server component is designed to work in conjunction with separate Apache web servers, which are often used when a reverse proxy web application architecture is required. Tomcat also provides a web server environment where Java application code can be deployed and run. This document is meant for use in conjunction with other STIGs such as the Enclave, Network Infrastructure, Secure Remote Computing, and appropriate operating system (OS) STIGs.Īpache Tomcat is a popular open source application server that provides a platform for Java Servlet, JavaServer Pages, Java Expression Language, and WebSocket technologies. The Apache Tomcat Application Server 9 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems.
0 kommentar(er)
