Tomcat Logging and HTTP Header question

[jmpaul012]

So I am doing Tomcat STIGS and I am stuck on two of the STIGs.

1.  How do I change what tomcat logs?  I think it's something I need to do in server.xml but I'm not sure.  This is what I need to log:

• Date, Time
• IP address of the host that initiated the request
• User ID supplied for HTTP authentication
• HTTP Method
• URL in the request
• The protocol and protocol version used to make the request
• Source and destination port numbers
• Status codes for the response
• Size of the response in bytes
• HTTP Status and Referrer for the following events:

- Successful and unsuccessful attempts to access the web server software.
- Successful and unsuccessful attempts to access the web site.
- Successful and unsuccessful attempts to access the web application.


2. How do I view/change the HTTP header information of an intranet site that is using Tomcat?  I have to make sure the HTTP header does not show information about the web server which would include, web server product, version, or host operating system

[André Warnier]

jmpaul012 wrote:
> So I am doing Tomcat STIGS and I am stuck on two of the STIGs.

It would be nice to explain acronyms, so that nincompoops like me would understand what's
going on without consulting Wikipedia..

>
> 1.  How do I change what tomcat logs?  I think it's something I need to do
> in server.xml but I'm not sure.  This is what I need to log:
>
> • Date, Time
> • IP address of the host that initiated the request
> • User ID supplied for HTTP authentication
> • HTTP Method
> • URL in the request
> • The protocol and protocol version used to make the request
> • Source and destination port numbers
> • Status codes for the response
> • Size of the response in bytes
> • HTTP Status and Referrer for the following events:
>
> - Successful and unsuccessful attempts to access the web server software.
> - Successful and unsuccessful attempts to access the web site.
> - Successful and unsuccessful attempts to access the web application.
>

Logging successful attempts should be feasible, but I can see problems for Tomcat logging
cases where the request doesn't even make it to Tomcat.

In any case, your first stop should probably be the on-line documentation for the
AccessLog Valve.



---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

[jmpaul012]

Sorry, the only acronym I really used was STIG, but I probably shouldn'tve included that in the question since it isn't really relavent to the question.  STIGs are security proceduers the govt has to lock down their software, servers, etc.

awarnier wrote

jmpaul012 wrote:
> So I am doing Tomcat STIGS and I am stuck on two of the STIGs.

It would be nice to explain acronyms, so that nincompoops like me would understand what's
going on without consulting Wikipedia..

>
> 1.  How do I change what tomcat logs?  I think it's something I need to do
> in server.xml but I'm not sure.  This is what I need to log:
>
> • Date, Time
> • IP address of the host that initiated the request
> • User ID supplied for HTTP authentication
> • HTTP Method
> • URL in the request
> • The protocol and protocol version used to make the request
> • Source and destination port numbers
> • Status codes for the response
> • Size of the response in bytes
> • HTTP Status and Referrer for the following events:
>
> - Successful and unsuccessful attempts to access the web server software.
> - Successful and unsuccessful attempts to access the web site.
> - Successful and unsuccessful attempts to access the web application.
>
Logging successful attempts should be feasible, but I can see problems for Tomcat logging
cases where the request doesn't even make it to Tomcat.

In any case, your first stop should probably be the on-line documentation for the
AccessLog Valve.



---------------------------------------------------------------------
To unsubscribe, e-mail: [e-mail]
For additional commands, e-mail: [e-mail]

[jmpaul012]

can anyone help??

jmpaul012 wrote

So I am doing Tomcat STIGS and I am stuck on two of the STIGs.

1.  How do I change what tomcat logs?  I think it's something I need to do in server.xml but I'm not sure.  This is what I need to log:

• Date, Time
• IP address of the host that initiated the request
• User ID supplied for HTTP authentication
• HTTP Method
• URL in the request
• The protocol and protocol version used to make the request
• Source and destination port numbers
• Status codes for the response
• Size of the response in bytes
• HTTP Status and Referrer for the following events:

- Successful and unsuccessful attempts to access the web server software.
- Successful and unsuccessful attempts to access the web site.
- Successful and unsuccessful attempts to access the web application.


2. How do I view/change the HTTP header information of an intranet site that is using Tomcat?  I have to make sure the HTTP header does not show information about the web server which would include, web server product, version, or host operating system

[Daniel Mikusa-2]

On Fri, 2011-12-02 at 09:10 -0800, jmpaul012 wrote:

> can anyone help??
>
>
> jmpaul012 wrote:
> >
> > So I am doing Tomcat STIGS and I am stuck on two of the STIGs.
> >
> > 1.  How do I change what tomcat logs?  I think it's something I need to do
> > in server.xml but I'm not sure.  This is what I need to log:
> >
> > • Date, Time
> > • IP address of the host that initiated the request
> > • User ID supplied for HTTP authentication
> > • HTTP Method
> > • URL in the request
> > • The protocol and protocol version used to make the request
> > • Source and destination port numbers
> > • Status codes for the response
> > • Size of the response in bytes
> > • HTTP Status and Referrer for the following events:
> >
> > - Successful and unsuccessful attempts to access the web server software.
> > - Successful and unsuccessful attempts to access the web site.
> > - Successful and unsuccessful attempts to access the web application.
> >

I believe this one was already answered.

> In any case, your first stop should probably be the on-line
> documentation for the AccessLog Valve.

https://tomcat.apache.org/tomcat-7.0-doc/config/valve.html#Access_Log_Valve


> >
> > 2. How do I view/change the HTTP header information of an intranet site
> > that is using Tomcat?  I have to make sure the HTTP header does not show
> > information about the web server which would include, web server product,
> > version, or host operating system
> >

I think you want the "server" attribute of the <Connector/> element.

https://tomcat.apache.org/tomcat-7.0-doc/config/http.html

Dan

[Christopher Schultz-2]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

To whom it may concern,

On 12/2/11 12:10 PM, jmpaul012 wrote:
>> So I am doing Tomcat STIGS and I am stuck on two of the STIGs.
>>
>> 1.  How do I change what tomcat logs?  I think it's something I
>> need to do in server.xml but I'm not sure.

What have you tried so far? This is a community mailing list, not a
consulting agency. We're here to help, not to do things for you.

>> This is what I need to log:
>>
>> • Date, Time • IP address of the host that initiated the request
>> • User ID supplied for HTTP authentication • HTTP Method • URL in
>> the request • The protocol and protocol version used to make the
>> request • Source and destination port numbers • Status codes for
>> the response • Size of the response in bytes • HTTP Status and
>> Referrer for the following events:

That sounds a lot like an HTTP access log. Have you looked through the
"logging" documentation for your version of Tomcat for how to do
access logging?

>> - Successful and unsuccessful attempts to access the web server
>> software.

Depends upon your definition of "successful", "attempt", and "access".

>> - Successful and unsuccessful attempts to access the web site.

Ditto.

>> - Successful and unsuccessful attempts to access the web
>> application.

Ditto.

>> 2. How do I view/change the HTTP header information of an
>> intranet site that is using Tomcat?  I have to make sure the HTTP
>> header does not show information about the web server which would
>> include, web server product, version, or host operating system

Generally speaking, it's nice to post different questions in separate
threads. It's not a huge deal, but it makes following a conversation
easier for others.

Anyhow, you are looking for changing the "Server" response header,
right? That's in the documentation as well, but it might not be the
easiest thing to find. See below.

Since you are looking at securing Tomcat, you might want to have a
look at the "Security Considerations" section of the Tomcat User Guide:
http://tomcat.apache.org/tomcat-7.0-doc/security-howto.html

(Make sure you use the right version -- I chose TC 7 because you never
told us what you were running).

Hope that helps,
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk7ZDaoACgkQ9CaO5/Lv0PB8QACgvfmekninLwMlIuafcwsG2WZ4
HnAAni9XbJ15C0/wv0RgiJuCaZavt/wQ
=GVw2
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

[jmpaul012]

Sorry I didn't mean to ask the questions as though this forum is my private consulting firm.  I have done everything I could before I posted on this forum.  I have searched google, experts exchange, asked coworkers, and asked my previous Tomcat professor.  I will use your suggestions and I hope I can figure this out.  Thanks!

Christopher Schultz-2 wrote

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

To whom it may concern,

On 12/2/11 12:10 PM, jmpaul012 wrote:
>> So I am doing Tomcat STIGS and I am stuck on two of the STIGs.
>>
>> 1.  How do I change what tomcat logs?  I think it's something I
>> need to do in server.xml but I'm not sure.

What have you tried so far? This is a community mailing list, not a
consulting agency. We're here to help, not to do things for you.

>> This is what I need to log:
>>
>> • Date, Time • IP address of the host that initiated the request
>> • User ID supplied for HTTP authentication • HTTP Method • URL in
>> the request • The protocol and protocol version used to make the
>> request • Source and destination port numbers • Status codes for
>> the response • Size of the response in bytes • HTTP Status and
>> Referrer for the following events:

That sounds a lot like an HTTP access log. Have you looked through the
"logging" documentation for your version of Tomcat for how to do
access logging?

>> - Successful and unsuccessful attempts to access the web server
>> software.

Depends upon your definition of "successful", "attempt", and "access".

>> - Successful and unsuccessful attempts to access the web site.

Ditto.

>> - Successful and unsuccessful attempts to access the web
>> application.

Ditto.

>> 2. How do I view/change the HTTP header information of an
>> intranet site that is using Tomcat?  I have to make sure the HTTP
>> header does not show information about the web server which would
>> include, web server product, version, or host operating system

Generally speaking, it's nice to post different questions in separate
threads. It's not a huge deal, but it makes following a conversation
easier for others.

Anyhow, you are looking for changing the "Server" response header,
right? That's in the documentation as well, but it might not be the
easiest thing to find. See below.

Since you are looking at securing Tomcat, you might want to have a
look at the "Security Considerations" section of the Tomcat User Guide:
http://tomcat.apache.org/tomcat-7.0-doc/security-howto.html

(Make sure you use the right version -- I chose TC 7 because you never
told us what you were running).

Hope that helps,
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk7ZDaoACgkQ9CaO5/Lv0PB8QACgvfmekninLwMlIuafcwsG2WZ4
HnAAni9XbJ15C0/wv0RgiJuCaZavt/wQ
=GVw2
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: [e-mail]
For additional commands, e-mail: [e-mail]

[Pid]

On 02/12/2011 18:12, jmpaul012 wrote:
>
> Sorry I didn't mean to ask the questions as though this forum is my private
> consulting firm.  I have done everything I could before I posted on this
> forum.  I have searched google, experts exchange, asked coworkers, and asked
> my previous Tomcat professor.  I will use your suggestions and I hope I can
> figure this out.  Thanks!

There are Tomcat professors?


p

> Christopher Schultz-2 wrote:
>>
> To whom it may concern,
>
> On 12/2/11 12:10 PM, jmpaul012 wrote:
>>>>> So I am doing Tomcat STIGS and I am stuck on two of the STIGs.
>>>>>
>>>>> 1.  How do I change what tomcat logs?  I think it's something I
>>>>> need to do in server.xml but I'm not sure.
>
> What have you tried so far? This is a community mailing list, not a
> consulting agency. We're here to help, not to do things for you.
>
>>>>> This is what I need to log:
>>>>>
>>>>> • Date, Time • IP address of the host that initiated the request
>>>>> • User ID supplied for HTTP authentication • HTTP Method • URL in
>>>>> the request • The protocol and protocol version used to make the
>>>>> request • Source and destination port numbers • Status codes for
>>>>> the response • Size of the response in bytes • HTTP Status and
>>>>> Referrer for the following events:
>
> That sounds a lot like an HTTP access log. Have you looked through the
> "logging" documentation for your version of Tomcat for how to do
> access logging?
>
>>>>> - Successful and unsuccessful attempts to access the web server
>>>>> software.
>
> Depends upon your definition of "successful", "attempt", and "access".
>
>>>>> - Successful and unsuccessful attempts to access the web site.
>
> Ditto.
>
>>>>> - Successful and unsuccessful attempts to access the web
>>>>> application.
>
> Ditto.
>
>>>>> 2. How do I view/change the HTTP header information of an
>>>>> intranet site that is using Tomcat?  I have to make sure the HTTP
>>>>> header does not show information about the web server which would
>>>>> include, web server product, version, or host operating system
>
> Generally speaking, it's nice to post different questions in separate
> threads. It's not a huge deal, but it makes following a conversation
> easier for others.
>
> Anyhow, you are looking for changing the "Server" response header,
> right? That's in the documentation as well, but it might not be the
> easiest thing to find. See below.
>
> Since you are looking at securing Tomcat, you might want to have a
> look at the "Security Considerations" section of the Tomcat User Guide:
> http://tomcat.apache.org/tomcat-7.0-doc/security-howto.html
>
> (Make sure you use the right version -- I chose TC 7 because you never
> told us what you were running).
>
> Hope that helps,
> -chris
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: [hidden email]
>> For additional commands, e-mail: [hidden email]
>>
>>
>>
>

--

[key:62590808]

[André Warnier]

Pid wrote:
>
> There are Tomcat professors?
>
I'd say that they fit right in with pet food tasters, dog walkers and chicken sexers, no ?


---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

[Lamini]

The STIG GroupID is V-13688

Copy/paste from the STIG (Apache Web Server - Site):

LogFormat "%a %A %h %H %l %m %s %t %u %U \"%{Referer}i\" " combined

Basically, run to your tomcat/conf folder (assuming tomcat6-7), open server.xml, scroll down to the logacess valve on the bottom, unrem (uncomment) the valve, and replace "common" with "combined"... you'll be compliant then... for the sake of being compliant (STIG is far from being well written).