Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (athena.apache.org: domain of unixhound@gmail.com
 designates 66.249.92.174 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:mime-version:content-type;
        b=IwdnDCY5rIEdSfdgzCFjOEQAP2CytHLdpkT5KkjnkDyXsV2SaXOrGEgjP0TWOOIEK/
         SB7qfsQhDgkQ6tBI6ftC+gEhva30W/KCGWAepz5ksIzfdcuRw+r0goCvJN4EcV9IFpPs
         CXKGryvbZnN19UWP/dTTIYvkJdFBAKL1ST3Vc=
Message-ID: <eaab04ed0806201037i15c1f865x8f4e2943ac48604a@mail.gmail.com>
Date: Fri, 20 Jun 2008 10:37:54 -0700
From: "Dave Girardin" <unixhound@gmail.com>
To: "Tomcat Users List" <users@tomcat.apache.org>
Subject: How to turn off Etag headers?
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_Part_8875_26790344.1213983474967"

------=_Part_8875_26790344.1213983474967
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Group,

I'm a Unix admin working on a Solaris 8 server running Tomcat 6.0.16. No
other apps run on the server, for example, there is no Apache httpd running.
I have been tasked with turning off Etag headers. Our security folks have
supposedly identified this security vulnerability, note that is says Apache
but it's really Tomcat:

Vulnerability Identified: Apache ETag Header Information Disclosure Weakness

Severity: Low

Description: A cache management feature is available for Apache that makes
use of an entity tag (ETag) header. When this option is enabled and a
request is made for a document relating to a file, for caching purposes, an
ETag response header is returned containing various file attributes. A
weakness has been found in the generation of ETag headers under certain
configurations implementing the FileETag directive.

Impact: Among the file attributes included in the header is the file inode
number that is returned to a client. This poses a security risk, as this
information may aid in launching attacks against other network-based
services. For instance, NFS uses inode numbers to generate file handles.

Recommendation: Disable ETag headers. Apache 1.3.22 and earlier are not
configurable to disable the use of inodes in ETag headers. Default behavior
in later versions will still release this sensitive information. OpenBSD has
released a patch that addresses this issue. Inode numbers returned from the
server are now encoded using a private hash to avoid the release of
sensitive information

Can anyone tell me how to disable the ETag headers? I have searched the
documentation and sorry if it's there I missed it.

Thanks!!

David

------=_Part_8875_26790344.1213983474967--