보안점검 이슈 (톰캣 서버 정보 노출)

나... 참... 별...

아래처럼 톰캣 server.xml 의 host 항목에 valve 설정값을 추가해주자. 추가로, 위에 Response 의 응답 내용 자체를 변경하려면

ErrorReportValve 를 확장해서 클래스를 재정의 하면 되겠다.

 <Host name="localhost"  appBase="webapps"
            unpackWARs="true" autoDeploy="true">

        <Valve className="org.apache.catalina.valves.RemoteIpValve"
          internalProxies="192\.168\.0\.10|192\.168\.0\.11"
          remoteIpHeader="x-forwarded-for"
          proxiesHeader="x-forwarded-by"
          protocolHeader="x-forwarded-proto" />

		<Valve className="org.apache.catalina.valves.ErrorReportValve" showReport="false" showServerInfo="false"/>
		
        <!-- SingleSignOn valve, share authentication between web applications
             Documentation at: /docs/config/valve.html -->
        <!--
        <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
        -->

        <!-- Access log processes all example.
             Documentation at: /docs/config/valve.html -->
        <!--
        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"  
               prefix="localhost_access_log." suffix=".txt" pattern="common" resolveHosts="false"/>
        -->
    		<Context docBase="directory-web" path="/directory-web" reloadable="true"/>
    		<Context docBase="bpa-web" path="/bpa-web" reloadable="true"/>
        	<!-- <Context docBase="bpa-web" path="/bpa-web" reloadable="false"/> -->
      </Host>