tomcat安全加固

-R 640 conf/*
3. 首次安装完成后立即删除webapps下面的所有代码
rm -rf /srv/apache-tomcat/webapps/*
4. 注释或删除 tomcat-users.xml 所有用户权限，看上去如下：
# cat conf/tomcat-users.xml
<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>
注释掉区域内所有内容
</tomcat-users>
5. 隐藏Tomcat版本信息
vim $CATALINA_HOME/conf/server.xml
<Connector port="80" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443"
maxThreads="8192"
minSpareThreads="64"
maxSpareThreads="128"
acceptCount="128"
enableLookups="false"
增加 server="casicloud"/>
6. 关闭不必要的接口及功能
vim $CATALINA_HOME/conf/server.xml
6.1去提到关闭服务接口
将<Server port="8005" shutdown="SHUTDOWN">改为<Server>
6.2关闭war包自动解压，自动部署
<Host appBase="webapps" autoDeploy="false" name="localhost" unpackWARs="false" xmlNamespaceAware="false"
xmlValidation="false">
6.3 注释掉除了服务端口外（8080 443 ）的所有connect
<!-- <Connector port="8009" protocol="AJP/1.3" redirectPort="8443"/>
-->
7. 禁止目录列表
vi /data/tomcat/conf/web.conf
<init-param>
<param-name>listings</param-name>
<param-value>false</param-value>
</init-param>
8. 设置cookie的httpOnly属性，防止
vi /data/tomcat/conf/context.xml
<Context useHttpOnly="true">
<WatchedResource>WEB-INF/web.xml</WatchedResource>
</Context>
vi /data/tomcat/conf/web.xml
<session-config>
<cookie-config>
<http-only>true</http-only>
<secure>true</secure>
</cookie-config>
</session-config>