The Manager Web app password must be configured as follows: -15 or more characters. -at least one lower case letter. -at least one upper case letter. -at least one number. -at least one special character.

An XCCDF Rule

Description

The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password. Satisfies: SRG-APP-000164, SRG-APP-000166, SRG-APP-000169

ID: SV-224785r1013867_rule
Version: ISEC-06-550700
Severity: Medium
References: CCI-004066
Updated: 23 days ago

Remediation Templates

To set a strong password on the Manager Web app, run the ISEC7 integrated installer or use the following manual procedure:

Log in to the ISEC7 SPHERE server.
Browse to <Drive>:\Program Files\ISEC7 SPHERE\Tomcat\conf and open Tomcat-Users.xml.
Open the Command Prompt and CD to <Drive>:\Program Files\ISEC7 SPHERE\Tomcat\bin.
Execute the following using sha command:
digest –a sha password*

*Where password is the 15 character password designated for the account.

Copy the output, which is the hashed digest password.
In Tomcat-Users.xml, add in the password for the user with the obfuscated output at <user password="**", where ** is the obfuscated password.

example: <user password="310c55aa3d5b42217e7f0e80ce30467d$100000$529cceb1fbc80f4f461fc1bd56219d79d9c94d4a8fc46abad0646f27e753ff9e" roles="manager-gui,manager-script" username="admin"/>

Save the file.
Open <Drive>:\Program Files\ISEC7 SPHERE\Tomcat\conf\server.xml with Notepad.exe.
Enter: <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
 resourceName="UserDatabase" digest=”sha”/>
Save the file.
Restart the ISEC7 SPHERE Web service using the services.msc.

Note: the password must meet the following complexity requirements:
-15 or more characters.
-at least one lower case letter.
-at least one upper case letter.
-at least one number.
-at least one special character.

The Manager Web app password must be configured as follows: -15 or more characters. -at least one lower case letter. -at least one upper case letter. -at least one number. -at least one special character.

Description

Remediation Templates

A Manual Procedure