serverxml-stig.patch

--- apache-tomcat-9.0.82/conf/server.xml.orig	2023-10-11 06:15:08.000000000 -0700
+++ apache-tomcat-9.0.82/conf/server.xml	2023-11-01 15:10:46.070928865 -0700
@@ -19,13 +19,14 @@
      define subcomponents such as "Valves" at this level.
      Documentation at /docs/config/server.html
  -->
-<Server port="8005" shutdown="SHUTDOWN">
+<Server port="-1" shutdown="SHUTDOWN">
   <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
   <!-- Security listener. Documentation at /docs/config/listeners.html
   <Listener className="org.apache.catalina.security.SecurityListener" />
   -->
   <!-- APR library loader. Documentation at /docs/apr.html -->
-  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
+  <!-- NOTE: ONLY TURN FIPS MODE ON IF YOU HAVE AN SSL CONNECTOR ENABLED; this is likely not true during your initial setup -->
+  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" FIPSMode="off" />
   <!-- Prevent memory leaks due to use of particular java/javax APIs-->
   <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
   <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
@@ -70,7 +71,10 @@
                connectionTimeout="20000"
                redirectPort="8443"
                maxParameterCount="1000"
-               />
+               xpoweredby="false"
+               server="webthing" 
+               address="admin must fill in"
+              />
     <!-- A "Connector" using the shared thread pool-->
     <!--
     <Connector executor="tomcatThreadPool"
@@ -78,6 +82,9 @@
                connectionTimeout="20000"
                redirectPort="8443"
                maxParameterCount="1000"
+               xpoweredby="false"
+               server="webthing" 
+               address="admin must fill in"
                />
     -->
     <!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443
@@ -89,8 +96,11 @@
     -->
     <!--
     <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
-               maxThreads="150" SSLEnabled="true"
+               maxThreads="150" SSLEnabled="true" SLEnabledProtocols="TLSv1.2"
                maxParameterCount="1000"
+               xpoweredby="false"
+               server="webthing" 
+               address="admin must fill in"
                >
         <SSLHostConfig>
             <Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
@@ -106,8 +116,11 @@
     -->
     <!--
     <Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
-               maxThreads="150" SSLEnabled="true"
+               maxThreads="150" SSLEnabled="true" SLEnabledProtocols="TLSv1.2"
                maxParameterCount="1000"
+               xpoweredby="false"
+               server="webthing" 
+               address="admin must fill in"
                >
         <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
         <SSLHostConfig>
@@ -119,16 +132,6 @@
     </Connector>
     -->
 
-    <!-- Define an AJP 1.3 Connector on port 8009 -->
-    <!--
-    <Connector protocol="AJP/1.3"
-               address="::1"
-               port="8009"
-               redirectPort="8443"
-               maxParameterCount="1000"
-               />
-    -->
-
     <!-- An Engine represents the entry point (within Catalina) that processes
          every request.  The Engine implementation for Tomcat stand alone
          analyzes the HTTP headers included with the request, and passes them
@@ -149,30 +152,26 @@
 
       <!-- Use the LockOutRealm to prevent attempts to guess user passwords
            via a brute-force attack -->
-      <Realm className="org.apache.catalina.realm.LockOutRealm">
-        <!-- This Realm uses the UserDatabase configured in the global JNDI
-             resources under the key "UserDatabase".  Any edits
-             that are performed against this UserDatabase are immediately
-             available for use by the Realm.  -->
-        <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
-               resourceName="UserDatabase"/>
+      <Realm className="org.apache.catalina.realm.LockOutRealm" failureCount="5" lockOutTime="600">
+        
       </Realm>
 
       <Host name="localhost"  appBase="webapps"
-            unpackWARs="true" autoDeploy="true">
+            unpackWARs="true" autoDeploy="false">
 
         <!-- SingleSignOn valve, share authentication between web applications
              Documentation at: /docs/config/valve.html -->
         <!--
         <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
         -->
-
+        <Valve className="org.apache.catalina.valves.ErrorReportValve" showServerInfo="false"/>
         <!-- Access log processes all example.
              Documentation at: /docs/config/valve.html
              Note: The pattern used is equivalent to using pattern="common" -->
         <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
                prefix="localhost_access_log" suffix=".txt"
-               pattern="%h %l %u %t &quot;%r&quot; %s %b" />
+               pattern="%h %l %u %t &quot;%r&quot; %s %b" 
+               requestAttributesEnabled="true" />
 
       </Host>
     </Engine>