Replacing the default Tomcat error page

The default Tomcat error page shows a full stacktrace which discloses sensitive information such as the Tomcat version. To avoid this, we recommend to modify the server configuration as follows.

About this task

Important: The setting affects all installed apps on the respective Tomcat instance.

Procedure

  1. Connect to the target server using your preferred ssh tool (e.g. putty) and log in.
  2. Become the root user:
    sudo su -
  3. Change to the folder /opt/eperi/gateway/tomcat/conf:
    cd /opt/eperi/gateway/tomcat/conf
  4. Open the server.xml file in an editor (e.g. nano server.xml).
  5. Add the following lines inside the <Host> tag:
    <Host name="localhost" appBase="webapps" unpackWARs="true" autoDeploy="true">
          <Valve className="org.apache.catalina.valves.ErrorReportValve"
                showReport="false"
                showServerInfo="false" />
    </Host>
  6. Save and exit the server.xml file.
  7. Restart eperi sEcure Platform:
    systemctl restart eperi-gateway
    Important: In a cluster setup, the changes must be made on every eperi sEcure Platform instance and each eperi sEcure Platform instance must be restarted.

Results

In case of an server error no sensitive information such as the Tomcat version is disclosed.