随着公司内部使用Tomcat作为web应用服务器的规模越来越大,为保证Tomcat的配置安全,防止信息泄露,恶性攻击以及配置的安全规范,特制定此Tomcat安全配置规范。
定位:仅对tomcat的安全配置部分进行标准规范。
适用版本范围:tomcat 6.*
[tomcat@tuan-node1 ~]# useradd -d /tomcat -u 501 tomcat
[tomcat@tuan-node1 ~]# passwd tomcat
[tomcat@tuan-node1 ~]# su - tomcat
[tomcat@tuan-node1 ~]$ id tomcat
uid=501(tomcat) gid=501(tomcat) groups=501(tomcat)
[tomcat@tuan-node1 ~]$ pwd
/tomcat
[tomcat@tuan-node1 ~]$ wget ftp://10.6.9.111/soft/apache-tomcat-6.0.35.tgz
[tomcat@tuan-node1 ~]$ wget ftp://10.6.9.111/soft/apache-tomcat-6.0.35.tgz.md5
[tomcat@tuan-node1 ~]$ md5sum -c apache-tomcat-6.0.35.tgz.md5
apache-tomcat-6.0.35.tar.gz: OK
[tomcat@tuan-node1 ~]$ wget ftp://10.6.9.111/soft/jdk1.6.0_22.tgz
[tomcat@tuan-node1 ~]$ wget ftp://10.6.9.111/soft/jdk1.6.0_22.tgz.md5
[tomcat@tuan-node1 ~]$ md5sum -c jdk1.6.0_22.tgz.md5
jdk1.6.0_22.tgz: OK
[tomcat@tuan-node1 ~]$ tar xzf apache-tomcat-6.0.35.tgz
[tomcat@tuan-node1 ~]$ tar xzf jdk1.6.0_22.tgz
vim .bash_profile 增加以下内容
export JAVA_HOME=/tomcat/jdk1.6.0_22
export PATH=$JAVA_HOME/bin:$JAVA_HOME/jre/bin:$PATH
export CLASSPATH=.$CLASSPATH:$JAVA_HOME/lib:$JAVA_HOME/jre/lib:$JAVA_HOME/lib/tools.jar
export TOMCAT_HOME=/tomcat/apache-tomcat-6.0.35
[tomcat@tuan-node1 ~]$source .bash_profile
[tomcat@tuan-node1 ~]$ java -version
java version "1.6.0_26"
Java(TM) SE Runtime Environment (build 1.6.0_26-b03)
Java HotSpot(TM) 64-Bit Server VM (build 20.1-b02, mixed mode)
[tomcat@tuan-node1 ~]$ mkdir webapps
将应用程序放置在/tomcat/目录下。建立相应的目录如团购wmw_tuan,静态化wmw_static,并修改server.xml,对应好目录即可
[tomcat@tuan-node1 ~]$ /tomcat/apache-tomcat-6.0.35/bin/startup.sh
Using CATALINA_BASE: /tomcat/apache-tomcat-6.0.35
Using CATALINA_HOME: /tomcat/apache-tomcat-6.0.35
Using CATALINA_TMPDIR: /tomcat/apache-tomcat-6.0.35/temp
Using JRE_HOME: /tomcat/jdk1.6.0_22
Using CLASSPATH: /tomcat/apache-tomcat-6.0.35/bin/bootstrap.jar
配置部分(${CATALINA_HOME}conf/server.xml)
<Server port="8527" shutdown=" dangerous">
<!-- Define a non-SSL HTTP/1.1 Connector on port 8080 -->
<Connector port="8080" server="webserver"/>
<!-- Define an AJP 1.3 Connector on port 8528 -->
<!--Define an accesslog -->
<Valve className="org.apache.catalina.valves.AccessLogValve"
directory="logs" prefix="localhost_access_log." suffix=".txt"
pattern="%h %l %u %t %r %s %b %{Referer}i %{User-Agent}i %D" resolveHosts="false"/>
<Connector port="8528" protocol="AJP/1.3" />
<Context path="" docBase="/home/work/local/tomcat_webapps" debug="0" reloadable="false" crossContext="true"/>
配置部分(${ CATALINA_HOME }conf/web.xml或者WEB-INF/web.xml)
<init-param>
<param-name>listings</param-name>
<param-value>false</param-value>
</init-param>
<error-page>
<error-code>403</error-code>
<location>/forbidden.jsp</location>
</error-page>
<error-page>
<error-code>404</error-code>
<location>/notfound.jsp</location>
</error-page>
<error-page>
<error-code>500</error-code>
<location>/systembusy.jsp</location>
</error-page>
删除如下tomcat的默认目录和默认文件
tomcat/webapps/*
tomcat/conf/tomcat-user.xml
去除其他用户对tomcat 起停脚本的执行权限
chmod 744 -R tomcat/bin/*