The ISEC7 SPHERE must remove any unnecessary users or groups that have permissions to the server.xml file in Apache Tomcat.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-224790	SRG-APP-000380	ISEC-06-551310	SV-224790r1013879_rule	2024-08-20	3

Description
Tomcat uses a port (defaults to 8005) as a shutdown port. Someone could Telnet to the machine using this port and send the default command SHUTDOWN. Tomcat and all web apps would shut down in that case, which is a denial-of-service attack and would cause an unwanted service interruption.

ℹ️ Check
Verify unnecessary users or groups that have permissions to the Server.xml file in Apache Tomcat have been removed. Browse to ProgramFiles\Isec7 SPHERE\Tomcat\Conf and select "Server.xml". Right-click and select "Properties". Select the security tab and verify no unnecessary account or groups have been granted permissions to the file. Verify no unnecessary users or groups have permissions to the file. If unnecessary users or groups that have permissions to the Server.xml file in Apache Tomcat have not been removed, this is a finding.

ℹ️ Check

Verify unnecessary users or groups that have permissions to the Server.xml file in Apache Tomcat have been removed. Browse to ProgramFiles\Isec7 SPHERE\Tomcat\Conf and select "Server.xml". Right-click and select "Properties". Select the security tab and verify no unnecessary account or groups have been granted permissions to the file. Verify no unnecessary users or groups have permissions to the file. If unnecessary users or groups that have permissions to the Server.xml file in Apache Tomcat have not been removed, this is a finding.

✔️ Fix
Log in to the ISEC7 SPHERE server. Browse to ProgramFiles\Isec7 SPHERE\Tomcat\Conf and select Server.xml. Right-click and select "Properties". Select the security tab and remove unnecessary accounts or groups that have been granted permissions to the Server.xml file.