ISSUE * NMAP reports security warning for tomcat ENVIRONMENT * Satellite 6.2 RESOLUTION * Disable HTTP TRACE Method for Apache --> https://access.redhat.com/solutions/884243 --> allowTrace="False" For both connectors --> /etc/tomcat/server.xml Then restart tomcat GOAL Add allowTrace=False lines by default as part of a Satellite Build
Hi Kurt, what are your thoughts about the security implications of this one to Satellite and the severity that should be applied?
We are planning to harden this in a future version of Satellite, please see: https://bugzilla.redhat.com/show_bug.cgi?id=1305782 in fact you can probably close this as a duplicate of the above.
Kurt, thank you for the quick feedback. Based on the input, I am going to close this one as a duplicate; however, please re-open with details, if there is any concern with this approach. Thanks! *** This bug has been marked as a duplicate of bug 1305782 ***
Reopened, as tomcat is configured by puppet-candlepin which doesn't seem to expose any many for customizing the server.yml. We'll need to enable that before the solution in the other BZ works for this too.
All of the tomcat documentation says the default is allowTrace is false, so not sure why nmap is being triggered. - http://tomcat.apache.org/tomcat-5.5-doc/config/http.html - http://tomcat.apache.org/tomcat-6.0-doc/config/http.html I looked at my local tomcat instance on Satellite 6.2 EL7, and TRACE is not enabled. [root@sat-rhel7 ~]# curl -v -X TRACE -k http://localhost:8080/candlepin/status * About to connect() to localhost port 8080 (#0) * Trying 127.0.0.1... * Connected to localhost (127.0.0.1) port 8080 (#0) > TRACE /candlepin/status HTTP/1.1 > User-Agent: curl/7.29.0 > Host: localhost:8080 > Accept: */* > < HTTP/1.1 405 Method Not Allowed < Server: Apache-Coyote/1.1 < Allow: POST, GET, DELETE, OPTIONS, PUT, HEAD < Content-Length: 0 < Date: Fri, 18 Nov 2016 18:04:51 GMT < * Connection #0 to host localhost left intact Likewise on EL6: [vagrant@sat-rhel7 ~]$ curl -v -X TRACE -k http://localhost:8080/candlepin/status * About to connect() to localhost port 8080 (#0) * Trying 127.0.0.1... * Connected to localhost (127.0.0.1) port 8080 (#0) > TRACE /candlepin/status HTTP/1.1 > User-Agent: curl/7.29.0 > Host: localhost:8080 > Accept: */* > < HTTP/1.1 405 Method Not Allowed < Server: Apache-Coyote/1.1 < Allow: POST, GET, DELETE, OPTIONS, PUT, HEAD < Content-Length: 0 < Date: Fri, 18 Nov 2016 18:05:45 GMT < * Connection #0 to host localhost left intact