Apache Tomcat Application Server 9 Security Technical Implementation Guide

The Apache Tomcat Application Server 9 Security Technical Implementation Guide (V3 R5) has 79 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

79STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R5

CurrentPublished Wed Sep 30 2026

$CATALINA_HOME folder must be owned by the root user, group tomcat.

Apache Tomcat Application Server 9 Security Technical Implementation Guide

Assessment Title

Rule Text

$CATALINA_HOME folder must be owned by the root user, group tomcat.

Description

Discussion Text

Tomcat file permissions must be restricted. The standard configuration is to have the folder where Tomcat is installed owned by the root user with the group set to tomcat. The $CATALINA_HOME environment variable should be set to the location of the root directory of the "binary" distribution of Tomcat.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-222986

Rule

SV-222986r1264576_rule

Severity

medium

Rule Version

TCAT-AS-001200

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Access the Tomcat server from the command line and execute the following OS command:

sudo find $CATALINA_HOME -follow -maxdepth 0 \(  ! -user root -o ! -group tomcat \) -ls

If no folders are displayed, this is not a finding.

If results indicate the $CATALINA_HOME folder ownership and group membership is not set to root:tomcat, this is a finding.

Implementation Procedure

Fix Text

Run the following commands on the Tomcat server:

sudo find $CATALINA_HOME -maxdepth 0 \( ! -user root \) | sudo xargs chown root

sudo find $CATALINA_HOME -maxdepth 0 \( ! -group tomcat \) | sudo xargs chgrp tomcat

STIG check 56 of 79 in the Apache Tomcat Application Server 9 STIG checklist

← Previous · V-222985Application user name must be logged.Next · V-222987 →$CATALINA_BASE/conf/ folder must be owned by root, group tomcat.