The Uniface Lectures are an ongoing series of free monthly technical webinars that cover a wide range of useful topics. In this Lectures webinar on Application & Infrastructure Security we cover the following topics: • Introduction • Tomcat hardening • Closing remarks Full webinar video recording can also be found on: youtube.com/unifacesme

2. Application & Infrastructure Security
Hardening Tomcat
Jason Huggins
Director, Global Delivery

3. Agenda
Introduction
Tomcat hardening
Closing remarks

4. So, why are we here?

5. Security
CIA triad
Risk Avoidance vs Risk Management
Cost
Impact
Recovery
Usability
Acceptance

6. “I don’t need to worry…”
...it’s an internal application
…our team would never
…we’ve never had a attack
…we’re not that interesting to hackers
…our data is public record
…I’m not doing web, I’m okay
…my password is strong
…it is too complicated

7. “…everyone needs to worry”
Accidental hacker
Cyber criminals
Not just a privacy issue
Increasingly connected, integrated and exposed
Desktop, web, mobile, {x} as a service
Developers must be aware

8. Only as strong as…
the weakest link

9. These alone are not the solution
This Photo by Unknown Author is licensed under CC BY-NC-SA
This Photo by Unknown Author is licensed under CC BY-NC-ND
Firewall
Antivirus
The “IT infrastructure” guy
Automatic updates

10. Not just applicable to web applications
Uniface Web
Application Server
(WASV)
Desktop
API
Mobile
Web
HTTP
HTTPS
SOAP
REST
Web
USP, DSP
Desktop
HTML container
Mobile
Hybrid, Web
API
SOAP, REST, UHTTP

11. Tomcat Hardening

12. What is hardening?
Enhancing the security
Closing loopholes
Turning off developer/debug options
Removing non-essential objects
Not volunteering information
Patching
A ‘process’ not just an ‘event’

13. Technical Architecture
Desktop
API
Mobile
Web
e
Uniface
Virtual
Machine
Server - Tomcat
e
Service
Engine - Catalina
e
Host
e
Context
Servlet - WRDServlet - WRD*
Servlet - WRDServlet – SRD*
Port (8009)<> Connector (AJP) <> Valve
Port (443) <> Connector (HTTPS) <> Valve
Port (80)<> Connector (HTTP) <> Valve UVM Connector
* WRD: Web Request Dispatcher, SRD: SOAP Request Dispatcher

14. SSL

15. SSL
Asymmetric Encryption
Public & Private Keys
Transport Layer Security (TLS)
Secure Sockets Layer (SSL)

16. Tomcat – Add Certificates / Keys
Create a key store
keytool -genkey -alias foo -keystore truststore.jks
keytool -delete -alias foo -keystore truststore.jks
Add CA cert
keytool -import -alias root -keystore truststore.jks -trustcacerts -file CA.cer
Add PKCS12 SSL key pair
keytool -importkeystore -destkeystore truststore.jks -srckeystore tomcat.p12 -srcstoretype
PKCS12
Note: The certificate key and keystore passwords need to match

17. Tomcat – Configure SSL connector
server.xml – Uncomment the SSL connector
Add keystoreFile and keystorePass attributes
<Connector port="443“ protocol="org.apache.coyote.http11.Http11NioProtocol“
maxThreads="150“SSLEnabled="true" scheme="https" secure="true“clientAuth="false"
keystoreFile="truststore.jks“ keystorePass=“letmein“ sslProtocol="TLS" />
Set the recommended SSL ciphers
ciphers="TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_EC
DH_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES
_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,T
LS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_
WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_S
HA,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDH_RSA_WI
TH_AES_256_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,T
LS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WIT
H_AES_128_CBC_SHA,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA"

18. server.xml

19. Harden the defaults
Remove default applications
‘Examples’, ‘docs’, ‘host-manager’, content of ‘root’
Switch off the shutdown port
<Server port="-1" shutdown="SHUTDOWN">
Do not volunteer information
<Connector Server=" " port="443“ ……..
Prevent malicious deployments
<Host name="localhost" appBase="webapps“
unpackWARs="false" autoDeploy="false">

20. Harden the defaults (2)
Remove unused connectors e.g the AJP1.3
<!--Connector port="8009" protocol="AJP/1.3"
redirectPort="8443" / -->
Bind connectors to specific network cards
<Connector Secure="true" Server=" " address=“192.64.10.11"
port="8080“ protocol="HTTP/1.1" connectionTimeout="20000"
redirectPort="8443" />
Note: repeat whole connector block for each address and
create matching virtual hosts if multiple subdomains used.

21. Tomcat web.xml

22. Harden the defaults (3)
Reduce the default documents
<welcome-file-list>
<welcome-file>index.htm</welcome-file>
</welcome-file-list>
Force SSL
<security-constraint>
<web-resource-collection>
<web-resource-name>Protected Context</web-resource-name><url-pattern>/*</url-pattern>
</web-resource-collection>
<!-- auth-constraint goes here if you require authentication -->
<user-data-constraint><transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>

23. Reduced information exposure
Define generic pages 400, 404, 403 and 500 errors:
<error-page>
<error-code>400</error-code> <location>/error.htm</location>
</error-page>
<error-page>
<error-code>404</error-code> <location>/error.htm</location>
</error-page>
<error-page>
<error-code>403</error-code> <location>/error.htm</location>
</error-page>
<error-page>
<error-code>500</error-code> <location>/error.htm</location>
</error-page>
<error-page>
<exception-type>java.lang.Exception</exception-type> <location>/error.htm</location>
</error-page>

24. Context web.xml

25. Web app instance hardening
Prevent uniface middleware exposing information
<init-param>
<param-name>TESTABLE</param-name>
<param-value>false</param-value>
</init-param>
Tomcat timeouts
<session-config>
<session-timeout>20</session-timeout>
</session-config>

26. context.xml

27. Context wide hardening
Prevent client side access to cookies
<Context usehttponly="true">
Stop automatic reload/update of files
<!—
<WatchedResource>WEB-INF/web.xml</WatchedResource>
<WatchedResource>${catalina.base}/conf/web.xml</WatchedResource>
-->

28. filters: rewrite

29. URL rewriting
Hide actual URL’s and hinder direct access
Added the tomcat rewrite filter and rules
Rewrite rules examples:
RewriteCond %{REQUEST_URI} ^/talk$
RewriteRule ^/talk$ /messenger/wrd/main [L]
RewriteCond %{HTTP_REFERER} !(.*)/talk(.*)$
RewriteCond %{HTTP_REFERER} !(.*)/messenger(.*)$
RewriteRule ^(.*)$ /error.htm [L]
RewriteCond %{REQUEST_URI} ^/(css|common|img|dspjs|bootstrap-3.3.7-dist|index.htm|error.htm)(.*)$
RewriteRule ^(.*)$ /messenger$1 [L]
RewriteCond %{HTTP_REFERER} (.*)/talk(.*)$
RewriteCond %{REQUEST_URI} ^/(.*)$
RewriteRule ^(.*)$ /messenger/wrd$1 [L]
RewriteCond %{HTTP_REFERER} (.*)/messenger(.*)$
RewriteCond %{REQUEST_URI} ^/(.*)$

30. Other considerations

31. Uniface Application Errors
Application errors (i.e. Yellow Error Screens)
You can replace USYSHTTPBODY with the same html
that is used in the index and error pages referred to in
previous sections.

32. Uniface WRD errors
Infrastructure/configuration errors (i.e. Red Error Screens)
Templates in error_{locale} below the WEB-INF.

33. Practical Examples

34. Resources
Tomcat Security Documentation
https://tomcat.apache.org/tomcat-8.0-doc/security-howto.html
Open Web Application Security Project (OWASP)
https://www.owasp.org/
SSL Server Test
https://www.ssllabs.com/ssltest/index.html

35. Summary
Coach, train, mentor team
Continual monitoring and improvement are essential
A few simple steps greatly improve security
Server hardening is just one step along the path to security
Do not assume higher (or lower) layers provide adequate security
A 100% secure system is practically impossible
A 100% secure system would be unusable!

36. Thank You
& Questions