9.0.117.9.0.117.secretRequired="false". Mitigated by AJP lockdown or removal (Phase 3).dsm_om_connsvc (Phase 2).manager and host-manager deployed under FalconStor Tomcat. Standard hardening — not in customer scan but widely audited.server.xml. Audit and disable if not used as a redirect-only port.Snapshot first. All edits in later phases assume a clean rollback path — the baseline tarball is the source of truth. Tomcat is started by FalconStor's autovtl init script, not systemd, so service control commands later will go via that script.
If ss -tn | grep ':8009 ' returns no rows AND no mod_proxy_ajp config exists locally, AJP is unused — proceed with Option A (remove) in Phase 3. If anything is connected, treat as Option B (lock down).
If curl returns a 301/302 to https and access logs show only redirect responses, port 80 is acting as a courtesy redirect and is low risk. If it serves fms or obd directly over plaintext, that's a finding to fix.
Why this works: OMSA's hardware monitoring runs in dataeng, which is a separate service from the Tomcat-backed web GUI in dsm_om_connsvc. Disabling the web service removes the vulnerable Tomcat 9.0.34 from the network entirely while keeping inventory, alerts, and SNMP traps fully functional. omreport / omconfig CLI continue to work locally.
Note: If anyone uses the web GUI at https://b-prd-vtl:1311 for ad-hoc hardware checks, they will need to switch to omreport from the CLI, or query iDRAC directly out-of-band. Communicate this change before the cutover.
Why this matters more than the flagged CVEs: CVE-2020-1938 (Ghostcat) is a pre-auth file read / potential RCE. Any host that can reach 8009 with the connector in its current state can read arbitrary files from inside webapps and, in many configurations, execute uploaded JSPs. secretRequired="false" + no address= bind = wide open from any network interface this Tomcat listens on.
Restart deferred: Do not restart Tomcat yet — Phases 4 and 5 may require additional server.xml / webapp changes. Phase 6 handles the single coordinated restart.
FalconStor patch caveat: When FalconStor next ships an installer/patch, it may re-deploy manager and host-manager as part of its stock Tomcat tarball. Add a post-patch verification step to your FalconStor change procedure that re-runs the removal commands above. The backup tarball at /root/tomcat-baseline-*/mgr-webapps-removed.tar.gz is your rollback if FalconStor support insists either webapp is required.
If 80 is genuinely just a redirect and end-users rely on typing the hostname without https, leaving it in place is defensible. The vulnerability scanner is unlikely to flag a redirect-only connector. Document the decision either way in the change record.
Test the VTL itself. Beyond port checks, log into the FalconStor management UI (https://b-prd-vtl/fms) and confirm tape libraries, virtual tapes, replication jobs, and any backup-server clients are all reporting healthy. Run a non-disruptive backup test or verify a scheduled job completes successfully before signing off the change.
Open a re-scan request with the customer's vuln scanning team. Expected outcome: the AJP, manager-webapp, and OMSA-Tomcat findings should all clear. The original two CVEs (9.0.117) will remain open until the FalconStor patch lands — note this in the change record with the FalconStor case number as the linked remediation track.
Each phase has an independent rollback path — you do not have to roll back everything if only one change causes an issue. Identify the failing phase, restore only its artefacts, and proceed with the remainder.
/etc/rc.d/init.d/autovtl, not systemd. Do not attempt systemctl start tomcat — there is no such unit on this host.omreport CLI) continues to function with dsm_om_connsvc disabled — only the web GUI on port 1311 is removed.secretRequired="false" and no address bind. This is the highest-impact finding in the room and is not on the customer's scan report. Address it regardless of the FalconStor patch timeline.manager / host-manager webapps and may revert server.xml. Add a post-patch hardening verification step to your FalconStor change procedure.server.xml with xmllint --noout before every restart. A malformed connector block will prevent Tomcat starting and FalconStor's fms/obd with it.conf/ and any removed webapps under /root/tomcat-baseline-YYYYMMDD/ before editing.