Security Hardening

Remove Everything You Do Not Need

# on a production host, delete the sample apps
rm -rf webapps/docs webapps/examples webapps/host-manager
# optionally disable/secure manager and only keep ROOT + your app

Restrict the Manager

• Protect manager/host-manager with a strong user and restrict by remote IP:

<Valve className="org.apache.catalina.valves.RemoteAddrValve"
       allow="10.0.0.0/8,192.168.1.0/24"/>

• Never enable manager-gui on public-facing servers.

Hardening server.xml

• Disable AJP unless needed: comment/remove the 8009 connector.
• Run with scheme="https" and secure="true" on the HTTP connector when behind nginx TLS, or disable direct access entirely.
• Add security headers at the app/nginx layer (CSP, X-Frame-Options, HSTS).

Session Security

• Use HttpOnly cookies: in web.xml <session-config><cookie-config><http-only>true and <secure>true over HTTPS.
• Regenerate the session ID on login.
• Short session timeouts for admin apps.

General Hygiene

• Keep Tomcat and ALL jars in lib/ up to date; monitor CVEs.
• Run as an unprivileged user (tomcat), not root.
• Restrict file permissions: conf and keystores readable only by the tomcat user.
• Firewall: only expose 80/443 (or through nginx).

Key Points

• Default installs ship sample apps and open AJP - both are risks.
• Least privilege, updated software, secure cookies, restricted manager.
• Harden once, then re-check after every upgrade.