<p><br></p><p><br></p><p><br></p><p>뭐 어쩌다보니 톰캣의 버전을 올리게 되었다. KISA 권고사항이라서(?)</p><p><br></p><p>그랬더니 패키지 만들면서 했던 작업들이 생각이 잘 안나더라.</p><p>그래서 적어본다</p><p><br></p><div style="color: rgb(212, 212, 212); background-color: rgb(30, 30, 30); font-family: Consolas, &quot;Courier New&quot;, monospace; font-size: 14px; line-height: 19px; white-space: pre;"><div><span style="color: #6a9955;">#&nbsp;톰캣&nbsp;보안처리</span></div><div>https://tomcat.apache.org/tomcat-9.0-doc/config/http.html</div><br><div><span style="color: #6a9955;">#&nbsp;1.&nbsp;톰캣용&nbsp;에러&nbsp;페이지&nbsp;적용</span></div><div>https://motolies.tistory.com/776</div><br><div><span style="color: #6a9955;">#&nbsp;2.&nbsp;relaxedQueryChars&nbsp;옵션&nbsp;추가&nbsp;(server.xml&nbsp;&gt;&nbsp;connector)</span></div><div><span style="color: rgb(106, 153, 85);">#&nbsp;3.&nbsp;server&nbsp;에&nbsp;이름&nbsp;추가&nbsp;(server.xml&nbsp;&gt;&nbsp;connector)</span></div><div><span style="color: rgb(106, 153, 85);"><br></span></div><div style="color: rgb(212, 212, 212); background-color: rgb(30, 30, 30); font-family: Consolas, &quot;Courier New&quot;, monospace; font-size: 14px; line-height: 19px; white-space: pre;"><div style="line-height: 19px;"><div>&nbsp;&nbsp;<span style="color: #808080;">&lt;</span><span style="color: #569cd6;">Connector</span>&nbsp;<span style="color: #9cdcfe;">port</span>=<span style="color: #ce9178;">"80"</span>&nbsp;<span style="color: #9cdcfe;">protocol</span>=<span style="color: #ce9178;">"HTTP/1.1"</span>&nbsp;<span style="color: #9cdcfe;">connectionTimeout</span>=<span style="color: #ce9178;">"20000"</span>&nbsp;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #9cdcfe;">redirectPort</span>=<span style="color: #ce9178;">"443"</span>&nbsp;<span style="color: #9cdcfe;">URIEncoding</span>=<span style="color: #ce9178;">"UTF-8"</span>&nbsp;<span style="color: #9cdcfe;">relaxedQueryChars</span>=<span style="color: #ce9178;">"</span><span style="color: #569cd6;">&amp;lt;&amp;gt;&amp;quot;&amp;#39;</span><span style="color: #ce9178;">"</span>&nbsp;<span style="color: #9cdcfe;">maxPostSize</span>=<span style="color: #ce9178;">"-1"</span>&nbsp;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #9cdcfe;">maxThreads</span>=<span style="color: #ce9178;">"500"</span>&nbsp;<span style="color: #9cdcfe;">maxHttpHeaderSize</span>=<span style="color: #ce9178;">"8192"</span>&nbsp;<span style="color: #9cdcfe;">emptySessionPath</span>=<span style="color: #ce9178;">"true"</span>&nbsp;<span style="color: #9cdcfe;">enableLookups</span>=<span style="color: #ce9178;">"false"</span>&nbsp;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #9cdcfe;">acceptCount</span>=<span style="color: #ce9178;">"100"</span>&nbsp;<span style="color: #9cdcfe;">disableUploadTimeout</span>=<span style="color: #ce9178;">"true"</span>&nbsp;<span style="color: #9cdcfe;">server</span>=<span style="color: #ce9178;">"PCOFF"</span>&nbsp;<span style="color: #808080;">/&gt;</span></div></div></div><div><br></div><div><span style="color: #6a9955;">#&nbsp;4.&nbsp;server&nbsp;정보&nbsp;숨기기(tomcat/lib/catalina.jar 파일 풀어서 ServerInfo.properties 수정)</span></div><div>server.info=Apache&nbsp;Tomcat</div><div><div style="line-height: 19px;"><div>server.number=</div><div>server.built=</div></div></div><br><div><span style="color: #6a9955;">#&nbsp;5.&nbsp;메소드&nbsp;제한하기(web.xml&nbsp;&gt;&nbsp;security-constraint)</span></div><div>https://offbyone.tistory.com/179</div><br><div>&nbsp;&nbsp;&nbsp;&nbsp;&lt;security-constraint&gt;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;web-resource-collection&gt;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;web-resource-name&gt;restricted&nbsp;methods&lt;/web-resource-name&gt;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;url-pattern&gt;/*&lt;/url-pattern&gt;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;http-method&gt;HEAD&lt;/http-method&gt;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;http-method&gt;PUT&lt;/http-method&gt;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;http-method&gt;PATCH&lt;/http-method&gt;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;http-method&gt;CONNECT&lt;/http-method&gt;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;http-method&gt;OPTIONS&lt;/http-method&gt;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;http-method&gt;TRACE&lt;/http-method&gt;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/web-resource-collection&gt;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;auth-constraint&nbsp;/&gt;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&lt;/security-constraint&gt;</div><br><div><span style="color: #6a9955;">#&nbsp;6.&nbsp;ciphers&nbsp;설정&nbsp;(server.xml&nbsp;&gt;&nbsp;connector)</span></div><div>ciphers="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,</div><div>TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,</div><div>TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,</div><div>TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,</div><div>TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_CBC_SHA256,</div><div>TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,</div><div>SSL_RSA_WITH_3DES_EDE_CBC_SHA"</div><br><br></div><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p>


[Tomcat] 톰캣에서의 보안설정 몇 가지