Apache Tomcat Security
Remove Version Number from Error Pages
Assumes a JDK is in your PATHNote that making this change may prevent Lambda/Psi Probe (popular Tomcat monitoring webapp) to initialise as it cannot determine the Tomcat version.cd /tomcat/latest/lib
jar xf catalina.jar org/apache/catalina/util/ServerInfo.properties
vi org/apache/catalina/util/ServerInfo.properties # (server.info=Apache Tomcat)
jar uf catalina.jar org/apache/catalina/util/ServerInfo.properties
rm -r org
Restart Apache Tomcat...
systemctl restart tomcat
Remove HTTP Access to Release Notes
By default, this URL will work from any browser on the network (firewall rules permitting)...
http://mytomcatserver:8080/RELEASE-NOTES.txt
This document will generally reveal the version number of Tomcat.
To address this, simply remove the RELEASE-NOTES.txt file from production Tomcat servers...
rm /tomcat/latest/webapps/ROOT/RELEASE-NOTES.txt
Replace favicon.ico
Default favicon.ico files can be flagged during penetration test because they identify the software in use. To avoid this situation follow the notes below.
Identify a suitable replacement favicon.ico. Either use one of the many online favicon.ico designer tools or find a nondescript one from another server.
To replace the Tomcat favicon.ico:
cd /tomcat/latest/webapps/ROOT
cp favicon.ico favicon.icoO # Backup existing favicon
Replace favicon.ico with your alternate icon.