Silent Authentication must be removed from the Default Management Security Realm.
An XCCDF Rule
Description
Silent Authentication is a configuration setting that allows local OS users access to the JBoss server and a wide range of operations without specifically authenticating on an individual user basis. By default $localuser is a Superuser. This introduces an integrity and availability vulnerability and violates best practice requirements regarding accountability.
- ID
- SV-213501r960792_rule
- Version
- JBOS-AS-000050
- Severity
- High
- References
- Updated
Remediation Templates
A Manual Procedure
Log on to the OS of the JBoss server with OS permissions that allow access to JBoss.
Using the relevant OS commands and syntax, cd to the <JBOSS_HOME>/bin/ folder.
Run the jboss-cli script.
Connect to the server and authenticate.
Remove the local element from the Management Realm.