/TOMCAT-9-STIG

STIG Baseline Ansible Role for Tomcat 9

Primary LanguageJinjaMIT LicenseMIT

Tomcat 9 STIG

This role will apply the STIG security standard to your Tomcat 9 instance.

Requirements

Tomcat - 9 RHEL - 7 or 8 CentOS - 7 or 8 Ubuntu - 16.04, 18.04, or 20.04

Tomcat installed and running (or able to be in a running state). Required packages that are not included in the role are listed below

  • gcc - This should be installed by default but confirm it is installed and up to date.
  • Latest APR version - The APR software is located on the Apache website, http://apache.spd.co.il//apr/. Find the latest version (apr-1.7.0.tar.gz for example)
  • Latest APR-Util - The APR-Util software is located on the Apache website, http://apache.spd.co.il//apr/. Find the latest version (apr-util-1.6.1.tar.gz for example)
  • OpenSSL - The FIPS capable OpenSSL package needs to be installed.
  • Latest JDK - This should be in included with your Tomcat package in $CATALINA_HOME/bin folder in tomcat-native.tar.gz. Run tar that file and manually ./configure, make, and make install. The ./configure needs a number of options set, it is advised to research before running.

Role Variables

All variables are defined in the defaults/main.yml file. The top portion of the file controls main role related variables. These include toggles to enable/disable entire categories or individual tasks. Other variables are the non-privileged UID start point, automate package upgrades, etc. Other variables are for specific controls and are designed to take local system/site data. The goal with this setup is the end user will not have to modify the task itself to take on specific site settings.

Name Default Value Description
tcat_cat1_patch true Correct CAT I findings
tcat_cat2_patch true Correct CAT II findings
tcat_cat3_patch true Correct CAT III findings
tcat_as_###### see defaults/main.yml Individual variables to enable/disable each STIG ID.
tcat_skip_for_travis false Skip travis related items.
tcat_system_is_chroot false tweak role to run in a chroot, such as in kickstart %post script.
tcat_automate_install true This toggle will install the needed packages for your web server.
tcat_automate_package_upgrades true There are tasks that ask if you to be on the latest version. This toggle will upgrade to the latest packages.
tcat_disruption_high true Toggle to run/skip disruptive tasks .
tcat_non_privileged_uid 1000 The value where non-privileged UID's start.
catalina_home_dir var The home folder for the tomcat install, value found by task in prelim.yml.
tcat_default_storepass password1 Default keystore password. Should be moved to vaul.
tcat_jndi_realm.connection_url ldaps://localhost:686 LDAP server address.
tcat_jndi_realm.user_pattern uid={0},ou=people,dc=myunit,dc=mil JNDI Realm user pattern.
tcat_jndi_realm.role_base ou=groups,dc=myunit,dc=mil JNDI Realm role base.
tcat_jndi_realm.role_name cn JNDI Realm role name.
tcat_jndi_realm.role_search (uniqueMember={0}) JNDI Realm role search.
tcat_access_log_valve.prefix localhost_access_log AccessLogValve prefix.
tcat_access_log_valve.suffix .txt AccessLogVavle suffix.
tcat_access_log_valve.patther h %l %u %t "%r" %s %b" AccessLogValve pattern.
tcat_routable_ip_proxy Toggle if your proxy is using a routable IP address or an RFC 1918 Class B address space.
tcat_remoteipvalve_proxy_addresses 172.16.0.10 172.16.0.11
tcat_manager_host_manager_removed false Disables config injection that is not needed if manager and host-manager applications have been removed.
tcat_jmx_management false JMX management in use.
tcat_jmxremote_host 192.168.0.150 JMX Management IP address.
tcat_remote_cidr_valve false RemoteAddrValve in use.
tcat_remoteaddrevalve_value 127.\d+.\d+.\d+ ::1
tcat_connection_proxy_address 127.0.0.1 List of IP addresses that are used in connectors that are behind proxies.
tcat_lockoutrealm_failurecount 5 The number of failed attempts before lockout.
tcat_lockoutrealm_lockouttime 600 The duration of the lockout.
tcat_clustering_enabled true Set teh simpleTcpCluster in server.xml.
tcat_big_access_log_valve list List of AccessLogValve items for nested loop.
tcat_max_active_sessions 10 The number of simultaneous active sessions allowed.
tcat_privileged_context_need false Toggle the need for the privileged attribute in context.xml.
tcat_listen_address 192.168.0.145 The address the connector interface will listen on.

Dependencies

A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.

Role Structure

Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:

  • defaults

    • main.yml - This file contains all of the variables used within the role. The variables are set as dummy/default values and can be changed directly in main.yml or via the extra vars section in Tower.

  • files

    • This folder is not currently used, but is for files that would be copied to hosts via a task

  • handlers

    • main.yml - This folder is for handlers, which are tasks that run after the role. Currently we have one handler that will restart Tomcat after the role has been run and the handler was notified by a task.

  • meta

    • This folder is not used, but is for defining metadata for a role

  • tasks

    • main.yml - This is the file that determines which categories to run based on the tcat_catX_patch variable.
    • prelim.yml - This is the file that runs any preliminary tasks needed.
    • fix-cat1.yml - This contains all of the tasks needed to perform Category 1 controls
    • fix-cat2.yml - This contains all of the tasks needed to perform Category 2 controls
    • fix-cat3.yml - This contains all of the tasks needed to perform Category 3 controls

  • templates

    • 401_template.jsp.j2 - This is a template file for the 401 error messages. This needs to be customized to your local site
    • 403_template.jsp.j2 - This is a template file for the 403 error messages. This needs to be customized to your local site
    • 404_template.jsp.j2 - This is a template file for the 404 error messages. This needs to be customized to your locatl site

  • tests

    • This folder is not used

  • vars

    • This folder is not used, but would be used for extra variables needed for the role. We use defaults/main.yml for variables in our role since that has the lowest precedence and will be easily overwritten if needed (i.e. Tower).

  • site.yml - This is the main .yml file for the role and tells Ansible to play the role within its own directory.