When hardening a WAS (in this case I am using Tomcat), OWASP recommends to apply this Linux permissions to the
Make sure tomcat user has read/write access to /tmp and write (300 - yes, only write/execute) access to CATALINA_HOME/logs
Can someone explain why is the harm in allowing
read permission (since using it simplifies management via remote tools without having to use
After the answers, I think I understand better the issue and how to combine security with convenience. I suppose a solution could be to use
- use permissions 350
- change owner to tomcat:admin
- run the aplication with user tomcat, so if it is exploited, the user will not have read access to the logs, but the users in the admin group will, so they can check the logs with their tools remotely.