Skip to content
ATO Pathways
  Log In

JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-APP-000141-AS-000095

    <GroupDescription></GroupDescription>
    Group
    Show

  • JBoss process owner execution permissions must be limited.

    &lt;VulnDiscussion&gt;JBoss EAP application server can be run as the OS admin, which is not advised. Running the application server with admin pri...
    Rule High Severity
    Show

  • SRG-APP-000141-AS-000095

    <GroupDescription></GroupDescription>
    Group
    Show

  • JBoss QuickStarts must be removed.

    &lt;VulnDiscussion&gt;JBoss QuickStarts are demo applications that can be deployed quickly. Demo applications are not written with security in min...
    Rule Medium Severity
    Show

  • SRG-APP-000141-AS-000095

    <GroupDescription></GroupDescription>
    Group
    Show

  • Remote access to JMX subsystem must be disabled.

    &lt;VulnDiscussion&gt;The JMX subsystem allows you to trigger JDK and application management operations remotely. In a managed domain configuratio...
    Rule Medium Severity
    Show

  • SRG-APP-000141-AS-000095

    <GroupDescription></GroupDescription>
    Group
    Show

  • Welcome Web Application must be disabled.

    &lt;VulnDiscussion&gt;The Welcome to JBoss web page provides a redirect to the JBoss admin console, which, by default, runs on TCP 9990 as well as ...
    Rule Low Severity
    Show

  • SRG-APP-000141-AS-000095

    <GroupDescription></GroupDescription>
    Group
    Show

  • Any unapproved applications must be removed.

    &lt;VulnDiscussion&gt;Extraneous services and applications running on an application server expands the attack surface and increases risk to the ap...
    Rule Medium Severity
    Show

  • SRG-APP-000142-AS-000014

    <GroupDescription></GroupDescription>
    Group
    Show

  • JBoss application and management ports must be approved by the PPSM CAL.

    &lt;VulnDiscussion&gt;Some networking protocols may not meet organizational security requirements to protect data and components. Application serv...
    Rule Medium Severity
    Show

  • SRG-APP-000148-AS-000101

    <GroupDescription></GroupDescription>
    Group
    Show

  • JBoss KeyStore and Truststore passwords must not be stored in clear text.

    &lt;VulnDiscussion&gt;Access to the JBoss Password Vault must be secured, and the password used to access must be encrypted. There is a specific p...
    Rule Medium Severity
    Show

  • The JBoss Server must be configured to utilize a centralized authentication mechanism such as AD or LDAP.

    &lt;VulnDiscussion&gt;To assure accountability and prevent unauthorized access, application server users must be uniquely identified and authentica...
    Rule Medium Severity
    Show

  • SRG-APP-000149-AS-000102

    <GroupDescription></GroupDescription>
    Group
    Show

  • The JBoss Server must be configured to use certificates to authenticate admins.

    &lt;VulnDiscussion&gt;Multifactor authentication creates a layered defense and makes it more difficult for an unauthorized person to access the app...
    Rule Medium Severity
    Show

  • SRG-APP-000153-AS-000104

    <GroupDescription></GroupDescription>
    Group
    Show

  • The JBoss server must be configured to use individual accounts and not generic or shared accounts.

    &lt;VulnDiscussion&gt;To assure individual accountability and prevent unauthorized access, application server users (and any processes acting on be...
    Rule Medium Severity
    Show

  • SRG-APP-000163-AS-000111

    <GroupDescription></GroupDescription>
    Group
    Show

  • JBoss management Interfaces must be integrated with a centralized authentication mechanism that is configured to manage accounts according to DoD policy.

    &lt;VulnDiscussion&gt;JBoss EAP provides a security realm called ManagementRealm. By default, this realm uses the mgmt-users.properties file for a...
    Rule Medium Severity
    Show

  • SRG-APP-000171-AS-000119

    <GroupDescription></GroupDescription>
    Group
    Show

  • The JBoss Password Vault must be used for storing passwords or other sensitive configuration information.

    &lt;VulnDiscussion&gt;JBoss EAP 6 has a Password Vault to encrypt sensitive strings, store them in an encrypted keystore, and decrypt them for appl...
    Rule Medium Severity
    Show

  • SRG-APP-000171-AS-000119

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-APP-000172-AS-000120

    <GroupDescription></GroupDescription>
    Group
    Show

  • LDAP enabled security realm value allow-empty-passwords must be set to false.

    &lt;VulnDiscussion&gt;Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmissi...
    Rule Medium Severity
    Show

  • SRG-APP-000172-AS-000121

    <GroupDescription></GroupDescription>
    Group
    Show

  • JBoss must utilize encryption when using LDAP for authentication.

    &lt;VulnDiscussion&gt;Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmissi...
    Rule Medium Severity
    Show

  • SRG-APP-000176-AS-000125

    <GroupDescription></GroupDescription>
    Group
    Show

  • The JBoss server must be configured to restrict access to the web servers private key to authenticated system administrators.

    &lt;VulnDiscussion&gt;The cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, t...
    Rule Medium Severity
    Show

  • SRG-APP-000211-AS-000146

    <GroupDescription></GroupDescription>
    Group
    Show

  • The JBoss server must separate hosted application functionality from application server management functionality.

    &lt;VulnDiscussion&gt;The application server consists of the management interface and hosted applications. By separating the management interface ...
    Rule Medium Severity
    Show

  • SRG-APP-000231-AS-000133

    <GroupDescription></GroupDescription>
    Group
    Show

  • JBoss file permissions must be configured to protect the confidentiality and integrity of application files.

    &lt;VulnDiscussion&gt;The JBoss EAP Application Server is a Java-based AS. It is installed on the OS file system and depends upon file system acce...
    Rule Medium Severity
    Show

  • SRG-APP-000267-AS-000170

    <GroupDescription></GroupDescription>
    Group
    Show

  • Access to JBoss log files must be restricted to authorized users.

    &lt;VulnDiscussion&gt;If the application provides too much information in error logs and administrative messages to the screen, this could lead to ...
    Rule Medium Severity
    Show

  • SRG-APP-000316-AS-000199

    <GroupDescription></GroupDescription>
    Group
    Show

  • Network access to HTTP management must be disabled on domain-enabled application servers not designated as the domain controller.

    &lt;VulnDiscussion&gt;When configuring JBoss application servers into a domain configuration, HTTP management capabilities are not required on doma...
    Rule Medium Severity
    Show

  • SRG-APP-000340-AS-000185

    <GroupDescription></GroupDescription>
    Group
    Show

  • The application server must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

    &lt;VulnDiscussion&gt;Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or proce...
    Rule Medium Severity
    Show

  • SRG-APP-000343-AS-000030

    <GroupDescription></GroupDescription>
    Group
    Show

  • The JBoss server must be configured to log all admin activity.

    &lt;VulnDiscussion&gt;In order to be able to provide a forensic history of activity, the application server must ensure users who are granted a pri...
    Rule Medium Severity
    Show

  • SRG-APP-000358-AS-000064

    <GroupDescription></GroupDescription>
    Group
    Show

  • The JBoss server must be configured to utilize syslog logging.

    &lt;VulnDiscussion&gt;Information system logging capability is critical for accurate forensic analysis. Log record content that may be necessary to...
    Rule Medium Severity
    Show

  • SRG-APP-000380-AS-000088

    <GroupDescription></GroupDescription>
    Group
    Show

  • Production JBoss servers must not allow automatic application deployment.

    &lt;VulnDiscussion&gt;When dealing with access restrictions pertaining to change control, it should be noted that any changes to the software and/o...
    Rule Medium Severity
    Show

  • SRG-APP-000381-AS-000089

    <GroupDescription></GroupDescription>
    Group
    Show

  • Production JBoss servers must log when failed application deployments occur.

    &lt;VulnDiscussion&gt;Without logging the enforcement of access restrictions against changes to the application server configuration, it will be di...
    Rule Medium Severity
    Show

  • SRG-APP-000381-AS-000089

    <GroupDescription></GroupDescription>
    Group
    Show

  • Production JBoss servers must log when successful application deployments occur.

    &lt;VulnDiscussion&gt;Without logging the enforcement of access restrictions against changes to the application server configuration, it will be di...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules