The JBoss server must be configured to use individual accounts and not generic or shared accounts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-62281	JBOS-AS-000275	SV-76771r1_rule		Medium

Description
To assure individual accountability and prevent unauthorized access, application server users (and any processes acting on behalf of application server users) must be individually identified and authenticated. A group authenticator is a generic account used by multiple individuals. Use of a group authenticator alone does not uniquely identify individual users. Application servers must ensure that individual users are authenticated prior to authenticating via role or group authentication. This is to ensure that there is non-repudiation for actions taken.

Description

To assure individual accountability and prevent unauthorized access, application server users (and any processes acting on behalf of application server users) must be individually identified and authenticated. A group authenticator is a generic account used by multiple individuals. Use of a group authenticator alone does not uniquely identify individual users. Application servers must ensure that individual users are authenticated prior to authenticating via role or group authentication. This is to ensure that there is non-repudiation for actions taken.

STIG	Date
JBoss EAP 6.3 Security Technical Implementation Guide	2015-11-09

Details

Check Text ( C-63085r1_chk )
If the application server management interface is configured to use LDAP authentication this requirement is NA. Determine the mode in which the JBoss server is operating by authenticating to the OS, changing to the /bin/ folder and executing the jboss-cli script. Connect to the server and authenticate. Run the command: "ls" and examine the "launch-type" setting. User account information is stored in the following files for a JBoss server configured in standalone mode. The command line flags passed to the "standalone" startup script determine the standalone operating mode: /standalone/configuration/standalone.xml /standalone/configuration/standalone-full.xml /standalone/configuration/standalone.-full-ha.xml /standalone/configuration/standalone.ha.xml For a Managed Domain: /domain/configuration/domain.xml. Review both files for generic or shared user accounts. Open each xml file with a text editor and locate the section. Review the sub-section where "xxxxx" will be a user name. Have the system administrator identify the user of each user account. If user accounts are not assigned to individual users, this is a finding.

Check Text ( C-63085r1_chk )

If the application server management interface is configured to use LDAP authentication this requirement is NA.

Determine the mode in which the JBoss server is operating by authenticating to the OS, changing to the /bin/ folder and executing the jboss-cli script.
Connect to the server and authenticate.
Run the command: "ls" and examine the "launch-type" setting.

User account information is stored in the following files for a JBoss server configured in standalone mode. The command line flags passed to the "standalone" startup script determine the standalone operating mode:
/standalone/configuration/standalone.xml
/standalone/configuration/standalone-full.xml
/standalone/configuration/standalone.-full-ha.xml
/standalone/configuration/standalone.ha.xml

For a Managed Domain:
/domain/configuration/domain.xml.

Review both files for generic or shared user accounts.

Open each xml file with a text editor and locate the section.
Review the sub-section where "xxxxx" will be a user name.

Have the system administrator identify the user of each user account.

If user accounts are not assigned to individual users, this is a finding.

Fix Text (F-68201r1_fix)
Configure the application server so required users are individually authenticated by creating individual user accounts. Utilize an LDAP server that is configured according to DOD policy.