tomcat 安全

1. 删除默认 $CATALINA_HOME/webapps 下 (ROOT, balancer, jsp-examples, servlet-examples, tomcat-docs, webdav) 目录

2. 删除 $CATALINA_HOME/server/webapps (host-manager, manager) 注, 如需 CACTI, MRTG 监控 TOMCAT 流量，或者利用该管理目录进行部署管理而不需要重启 TOMCAT

3. 删除 CATALINA_HOME/conf/Catalina/localhost/host-manager.xml 与 $CATALINA_HOME/conf/Catalina/localhost/manager.xml  (低版本)

4. CATALINA_HOME/conf/web.xml

 <servlet>
   <servlet-name>default</servlet-name>
   <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
   <init-param>
     <param-name>debug</param-name>
     <param-value>0</param-value>
   </init-param>
   <init-param>
     <param-name>listings</param-name>
     <param-value>false</param-value>  <!-- make sure this is false -->
   </init-param>
   <load-on-startup>1</load-on-startup>
 </servlet>

5. 隐藏服务器版本信息， 当出现 404 错误页面，通常会暴漏服务器版本信息 

[root@tomcat_a ~]# curl -I http://localhost:8080
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Transfer-Encoding: chunked
Date: Tue, 17 Sep 2013 01:27:36 GMT

修改 $CATALINA_HOME/lib/catalina.jar

解压包

[root@tomcat_a lib]# jar xf catalina.jar org/apache/catalina/util/ServerInfo.properties

修改配置文件注，当前文件解压在当前目录下

[root@tomcat_a lib]# vi org/apache/catalina/util/ServerInfo.properties
server.info=hello kitty
server.number=hello kitty
server.built=www.mini189.cn

重新打包

[root@tomcat_a lib]# jar uf catalina.jar org/apache/catalina/util/ServerInfo.properties

重启 TOMCAT 生效

6. 修改 Server 检测返回信息， 该信息会导致漏洞检测工具报警 HTTP 版本过低

原效果

[root@tomcat_a bin]# curl -I http://localhost:8080
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Transfer-Encoding: chunked
Date: Tue, 17 Sep 2013 01:46:51 GMT

修改

root@tomcat_a /]# vi $CATALINA_HOME/conf/server.xml

    <Connector port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" server="hello kitty" />

重启后生效, 新效果

[root@tomcat_a /]# curl -I http://localhost:8080
HTTP/1.1 200 OK
Content-Type: text/html;charset=ISO-8859-1
Transfer-Encoding: chunked
Date: Tue, 17 Sep 2013 01:50:29 GMT
Server: hello kitty

7. 保护 8005 端口

注意， 8005 端口用于远程关闭 TOMCAT 部署

参考 $CATALINA_HOME/conf/server.xml

<Server port="8005" shutdown="SHUTDOWN">

确保端口受到防火墙保护