Imported from node011/Bounty-Reaper (.bountyreper/skill/CIS_benchmarks/Server_Software/Apache_Tomcat/CIS_Apache_Tomcat_10.1_Benchmark_v1.0.0/cis-tomcat101-6.1/SKILL.md). Install upstream with npx skills add node011/Bounty-Reaper --skill cis-tomcat101-6.1. Copyright stays with the author (CC-BY-NC-SA-4.0).

6.1 Setup Client-cert Authentication (Automated)

Name: cis-tomcat101-6.1
Author: node011

Profile Applicability

• Level 2

Description

Client-cert authentication requires that each client connecting to the server have a certificate to authenticate. This is generally regarded as stronger authentication than a password as it requires the client to have the certificate and not just know a password.

Rationale

Certificate based authentication is more secure than password based authentication.

Audit Procedure

Review the Connector configuration in server.xml and ensure the clientAuth is set to true and certificateVerification is set to required.

Remediation

In the Connector element, set the clientAuth parameter to true and the certificateVerification to required

<!-- Define a SSL Coyote HTTP/1.1 Connector on port 8443 -->

<Connector
  port="8443" minProcessors="5" maxProcessors="75"
  enablelookups="true" disableUploadTimeout="true"
  acceptCount="100" debug="0" scheme="https" secure="true";
  clientAuth="true" sslProtocol="TLS"/>
...
<Connector ...>
  <SSLHostConfig
    certificateVerification="required"
  />

Default Value

Not configured

References

CIS Controls

Controls Version: v8

Control: 5.2 Use Unique Passwords

Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character password for accounts not using MFA and a 14-character password for accounts not using MFA.

IG 1: • IG 2: • IG 3: •

Controls Version: v7

Control: 16.4 Encrypt or Hash all Authentication Credentials

Encrypt or hash with a salt all authentication credentials when stored.

IG 1: IG 2: • IG 3: •

Profile

Level 2

{ "ocm": "1", "id": "node011-bounty-reaper-cis-tomcat101-6-1", "kind": "skill", "name": "cis-tomcat101-6.1", "description": "Setup Client-cert Authentication", "publisher": "node011", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "cis", "tomcat", "linux", "java", "connector", "ssl", "tls", "client-cert", "github" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Setup Client-cert Authentication" ], "primary": false, "metadata": { "source": { "provider": "github", "repository": "https://github.com/node011/Bounty-Reaper", "path": ".bountyreper/skill/CIS_benchmarks/Server_Software/Apache_Tomcat/CIS_Apache_Tomcat_10.1_Benchmark_v1.0.0/cis-tomcat101-6.1/SKILL.md", "ref": "4c98784194514df06cd25ff18978d103f7485fb6", "url": "https://github.com/node011/Bounty-Reaper/blob/4c98784194514df06cd25ff18978d103f7485fb6/.bountyreper/skill/CIS_benchmarks/Server_Software/Apache_Tomcat/CIS_Apache_Tomcat_10.1_Benchmark_v1.0.0/cis-tomcat101-6.1/SKILL.md", "key": "node011/Bounty-Reaper/.bountyreper/skill/CIS_benchmarks/Server_Software/Apache_Tomcat/CIS_Apache_Tomcat_10.1_Benchmark_v1.0.0/cis-tomcat101-6.1/SKILL.md" }, "license": "CC-BY-NC-SA-4.0" }, "instructions": "# 6.1 Setup Client-cert Authentication (Automated)\n\n## Profile Applicability\n\n• Level 2\n\n## Description\n\nClient-cert authentication requires that each client connecting to the server have a certificate to authenticate. This is generally regarded as stronger authentication than a password as it requires the client to have the certificate and not just know a password.\n\n## Rationale\n\nCertificate based authentication is more secure than password based authentication.\n\n## Audit Procedure\n\nReview the Connector configuration in `server.xml` and ensure the `clientAuth` is set to `true` and `certificat", "cost": { "context_tokens": 463 } }

cis-tomcat101-6.1

About