Class SecurityListener

java.lang.Object
org.apache.catalina.security.SecurityListener
All Implemented Interfaces:
LifecycleListener
public class SecurityListener extends Object implements LifecycleListener
This listener must only be nested within Server elements.

  • Constructor Summary

    Constructors
    Constructor
    Description
    SecurityListener()
    Creates a new SecurityListener instance with "root" as the default prohibited OS user.

  • Method Summary

    Modifier and Type
    Method
    Description
    protected void
    checkOsUser()
    Checks that the current operating system user is not in the list of prohibited users.
    protected void
    checkServerBuildAge()
    Checks if the Tomcat build date exceeds the configured warning age threshold.
    protected void
    checkUmask()
    Checks that the operating system umask meets the minimum required value.
    protected void
    doChecks()
    Execute the security checks.
    int
    getBuildDateWarningAgeDays()
    Gets the number of days that may pass between the build-date of this Tomcat instance before warnings are printed.
    String
    getCheckedOsUsers()
    Returns the current list of operating system users not permitted to run Tomcat.
    String
    getMinimumUmask()
    Get the minimum umask that must be configured before Tomcat will start.
    void
    lifecycleEvent(LifecycleEvent event)
    Acknowledge the occurrence of the specified event.
    void
    setBuildDateWarningAgeDays(String ageDays)
    Sets the number of days that may pass between the build-date of this Tomcat instance before warnings are printed.
    void
    setCheckedOsUsers(String userNameList)
    Set the list of operating system users not permitted to run Tomcat.
    void
    setMinimumUmask(String umask)
    Set the minimum umask that must be configured before Tomcat will start.

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • SecurityListener

      public SecurityListener()
      Creates a new SecurityListener instance with "root" as the default prohibited OS user.

  • Method Details

    • lifecycleEvent

      public void lifecycleEvent(LifecycleEvent event)
      Description copied from interface: LifecycleListener
      Acknowledge the occurrence of the specified event.
      Specified by:
      lifecycleEvent in interface LifecycleListener
      Parameters:
      event - LifecycleEvent that has occurred

    • setCheckedOsUsers

      public void setCheckedOsUsers(String userNameList)
      Set the list of operating system users not permitted to run Tomcat. By default, only root is prevented from running Tomcat. Calling this method with null or the empty string will clear the list of users and effectively disables this check. Usernames will always be checked in a case-insensitive manner using the system default Locale.
      Parameters:
      userNameList - A comma separated list of operating system users not permitted to run Tomcat

    • getCheckedOsUsers

      public String getCheckedOsUsers()
      Returns the current list of operating system users not permitted to run Tomcat.
      Returns:
      A comma separated list of operating system usernames.

    • setMinimumUmask

      public void setMinimumUmask(String umask)
      Set the minimum umask that must be configured before Tomcat will start.
      Parameters:
      umask - The 4-digit umask as returned by the OS command umask

    • getMinimumUmask

      public String getMinimumUmask()
      Get the minimum umask that must be configured before Tomcat will start.
      Returns:
      The 4-digit umask as used by the OS command umask

    • setBuildDateWarningAgeDays

      public void setBuildDateWarningAgeDays(String ageDays)
      Sets the number of days that may pass between the build-date of this Tomcat instance before warnings are printed.
      Parameters:
      ageDays - The number of days a Tomcat build is allowed to age before logging warnings.

    • getBuildDateWarningAgeDays

      public int getBuildDateWarningAgeDays()
      Gets the number of days that may pass between the build-date of this Tomcat instance before warnings are printed.
      Returns:
      The number of days a Tomcat build is allowed to age before logging warnings.

    • doChecks

      protected void doChecks()
      Execute the security checks. Each check should be in a separate method.

    • checkOsUser

      protected void checkOsUser()
      Checks that the current operating system user is not in the list of prohibited users. Throws an Error if the user is prohibited.

    • checkUmask

      protected void checkUmask()
      Checks that the operating system umask meets the minimum required value. Skips the check on Windows. Throws an Error if the umask is insufficient.

    • checkServerBuildAge

      protected void checkServerBuildAge()
      Checks if the Tomcat build date exceeds the configured warning age threshold. Logs a warning if the build is too old or if the build date cannot be read.