cis-tomcat9-v120-7-2

name	cis-tomcat9-v120-7.2
description	Specify file handler in logging.properties files (Automated)
category	cis-tomcat
version	1.2.0
author	cyberstrike-official
tags	["cis","tomcat","linux","java","logging","log-files"]
cis_id	7.2
cis_benchmark	CIS Apache Tomcat 9 Benchmark v1.2.0
tech_stack	["linux","tomcat","java"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

7.2 Specify file handler in logging.properties files (Automated)

Description

Handlers specify where log messages are sent. Console handlers send log messages to the Java console and File handlers specify logging to a file.

Rationale

Utilizing file handlers will ensure that security event information is persisted to disk.

Impact

Configuring logging to debug logging, i.e. FINEST or ALL, can generate large amounts of information which may impact server performance.

Audit Procedure

Review each application's logging.properties file located in the applications $CATALINA_BASE/webapps/<app_name>/WEB-INF/classes directory and determine if the file handler properties are set.

$ grep handlers \
$ CATALINA_BASE/webapps/<app_name>/WEB-INF/classes/logging.properties

In the instance where an application specific logging has not been created, the logging.properties file will be located in $CATALINA_BASE/conf

$ grep handlers $CATALINA_BASE/conf/logging.properties

Remediation

Add the following entries, replacing <file_handler> with either FileHandler or AsyncFileHandler, to your logging.properties file if they do not exist.

handlers=1catalina.org.apache.juli.<file_handler>,
2localhost.org.apache.juli.<file_handler>,
3manager.org.apache.juli.<file_handler>, 4host-
manager.org.apache.juli.<file_handler>, java.util.logging.ConsoleHandler

Ensure logging is not off and set the <logging_level> to the desired level (SEVERE, WARNING, INFO, CONFIG, FINE, FINER, FINEST or ALL), for example:

org.apache.juli.FileHandler.level=<logging_level>

Default Value

No value for new applications by default.

References

1. https://tomcat.apache.org/tomcat-9.0-doc/logging.html

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	8.5 Collect Detailed Audit Logs Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation.