JBoss application and management ports must be approved by the PPSM CAL.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-62275	JBOS-AS-000255	SV-76765r1_rule		Medium

Description
Some networking protocols may not meet organizational security requirements to protect data and components. Application servers natively host a number of various features, such as management interfaces, httpd servers and message queues. These features all run on TCPIP ports. This creates the potential that the vendor may choose to utilize port numbers or network services that have been deemed unusable by the organization. The application server must have the capability to both reconfigure and disable the assigned ports without adversely impacting application server operation capabilities. For a list of approved ports and protocols, reference the DoD ports and protocols website at https://powhatan.iiie.disa.mil/ports/cal.html.

Description

Some networking protocols may not meet organizational security requirements to protect data and components. Application servers natively host a number of various features, such as management interfaces, httpd servers and message queues. These features all run on TCPIP ports. This creates the potential that the vendor may choose to utilize port numbers or network services that have been deemed unusable by the organization. The application server must have the capability to both reconfigure and disable the assigned ports without adversely impacting application server operation capabilities. For a list of approved ports and protocols, reference the DoD ports and protocols website at https://powhatan.iiie.disa.mil/ports/cal.html.

STIG	Date
JBoss EAP 6.3 Security Technical Implementation Guide	2015-11-09

Details

Check Text ( C-63079r1_chk )
Open the EAP web console by pointing a web browser to HTTPS://:9443 or HTTP://:9990 Log on to the admin console using admin credentials Select the "Configuration" tab Expand the "General Configuration" sub system by clicking on the + Select "Socket Binding" Select the "View" option next to "standard-sockets" Select "Inbound" Review the configured ports and determine if they are all approved by the PPSM CAL. If all the ports are not approved by the PPSM CAL, this is a finding.

Check Text ( C-63079r1_chk )

Open the EAP web console by pointing a web browser to HTTPS://:9443 or HTTP://:9990

Log on to the admin console using admin credentials
Select the "Configuration" tab
Expand the "General Configuration" sub system by clicking on the +
Select "Socket Binding"
Select the "View" option next to "standard-sockets"
Select "Inbound"

Review the configured ports and determine if they are all approved by the PPSM CAL.

If all the ports are not approved by the PPSM CAL, this is a finding.

Fix Text (F-68195r1_fix)
Open the EAP web console by pointing a web browser to HTTPS://:9990 Log on to the admin console using admin credentials Select the "Configuration" tab Expand the "General Configuration" sub system by clicking on the + Select "Socket Binding" Select the "View" option next to "standard-sockets" Select "Inbound" Select the port that needs to be reconfigured and select "Edit".