| V-62265 | High | JBoss process owner execution permissions must be limited. | JBoss EAP application server can be run as the OS admin, which is not advised. Running the application server with admin privileges increases the attack surface by granting the application server... |
| V-62327 | High | The JRE installed on the JBoss server must be kept up to date. | The JBoss product is available as Open Source; however, the Red Hat vendor provides updates, patches and support for the JBoss product. It is imperative that patches and updates be applied to... |
| V-62217 | High | Java permissions must be set for hosted applications. | The Java Security Manager is a java class that manages the external boundary of the Java Virtual Machine (JVM) sandbox, controlling how code executing within the JVM can interact with resources... |
| V-62223 | High | Silent Authentication must be removed from the Default Management Security Realm. | Silent Authentication is a configuration setting that allows local OS users access to the JBoss server and a wide range of operations without specifically authenticating on an individual user... |
| V-62325 | High | Production JBoss servers must be supported by the vendor. | The JBoss product is available as Open Source; however, the Red Hat vendor provides updates, patches and support for the JBoss product. It is imperative that patches and updates be applied to... |
| V-62229 | High | JBoss management interfaces must be secured. | JBoss utilizes the concept of security realms to secure the management interfaces used for JBoss server administration. If the security realm attribute is omitted or removed from the management... |
| V-62261 | High | JBoss process owner interactive access must be restricted. | JBoss does not require admin rights to operate and should be run as a regular user. In addition, if the user account was to be compromised and the account was allowed interactive logon rights,... |
| V-62227 | High | The JBoss server must be configured with Role Based Access Controls. | By default, the JBoss server is not configured to utilize role based access controls (RBAC). RBAC provides the capability to restrict user access to their designated management role, thereby... |
| V-62225 | High | The Java Security Manager must be enabled for the JBoss application server. | The Java Security Manager is a java class that manages the external boundary of the Java Virtual Machine (JVM) sandbox, controlling how code executing within the JVM can interact with resources... |
| V-62221 | High | Silent Authentication must be removed from the Default Application Security Realm. | Silent Authentication is a configuration setting that allows local OS users access to the JBoss server and a wide range of operations without specifically authenticating on an individual user... |
| V-62311 | Medium | Production JBoss servers must not allow automatic application deployment. | When dealing with access restrictions pertaining to change control, it should be noted that any changes to the software and/or application server configuration can potentially have significant... |
| V-62289 | Medium | JBoss KeyStore and Truststore passwords must not be stored in clear text. | Access to the JBoss Password Vault must be secured, and the password used to access must be encrypted. There is a specific process used to generate the encrypted password hash. This process must... |
| V-62293 | Medium | JBoss must utilize encryption when using LDAP for authentication. | Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission.
Application servers have the capability to utilize LDAP... |
| V-62245 | Medium | JBoss must be configured to record the IP address and port information used by management interface network traffic. | Application server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
Ascertaining... |
| V-62281 | Medium | The JBoss server must be configured to use individual accounts and not generic or shared accounts. | To assure individual accountability and prevent unauthorized access, application server users (and any processes acting on behalf of application server users) must be individually identified and... |
| V-62291 | Medium | LDAP enabled security realm value allow-empty-passwords must be set to false. | Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. If passwords are not encrypted, they can be plainly read (i.e.,... |
| V-62267 | Medium | JBoss QuickStarts must be removed. | JBoss QuickStarts are demo applications that can be deployed quickly. Demo applications are not written with security in mind and often open new attack vectors. QuickStarts must be removed. |
| V-62283 | Medium | The JBoss server must be configured to bind the management interfaces to only management networks. | JBoss provides multiple interfaces for accessing the system. By default, these are called "public" and "management". Allowing non-management traffic to access the JBoss management interface... |
| V-62275 | Medium | JBoss application and management ports must be approved by the PPSM CAL. | Some networking protocols may not meet organizational security requirements to protect data and components.
Application servers natively host a number of various features, such as management... |
| V-62231 | Medium | The JBoss server must generate log records for access and authentication events to the management interface. | Log records can be generated from various components within the JBoss application server. The minimum list of logged events should be those pertaining to access and authentication events to the... |
| V-62277 | Medium | The JBoss Server must be configured to utilize a centralized authentication mechanism such as AD or LDAP. | To assure accountability and prevent unauthorized access, application server users must be uniquely identified and authenticated. This is typically accomplished via the use of a user store that... |
| V-62279 | Medium | The JBoss Server must be configured to use certificates to authenticate admins. | Multifactor authentication creates a layered defense and makes it more difficult for an unauthorized person to access the application server. If one factor is compromised or broken, the attacker... |
| V-62273 | Medium | Any unapproved applications must be removed. | Extraneous services and applications running on an application server expands the attack surface and increases risk to the application server. Securing any server involves identifying and removing... |
| V-62249 | Medium | JBoss ROOT logger must be configured to utilize the appropriate logging level. | Information system logging capability is critical for accurate forensic analysis. Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source... |
| V-62297 | Medium | The JBoss server must separate hosted application functionality from application server management functionality. | The application server consists of the management interface and hosted applications. By separating the management interface from hosted applications, the user must authenticate as a privileged... |
| V-62295 | Medium | The JBoss server must be configured to restrict access to the web servers private key to authenticated system administrators. | The cornerstone of the PKI is the private key used to encrypt or digitally sign information.
If the private key is stolen, this will lead to the compromise of the authentication and... |
| V-62301 | Medium | Access to JBoss log files must be restricted to authorized users. | If the application provides too much information in error logs and administrative messages to the screen, this could lead to compromise. The structure and content of error messages need to be... |
| V-62233 | Medium | JBoss must be configured to allow only the ISSM (or individuals or roles appointed by the ISSM) to select which loggable events are to be logged. | The JBoss server must be configured to select which personnel are assigned the role of selecting which loggable events are to be logged.
In JBoss, the role designated for selecting auditable... |
| V-62303 | Medium | Network access to HTTP management must be disabled on domain-enabled application servers not designated as the domain controller. | When configuring JBoss application servers into a domain configuration, HTTP management capabilities are not required on domain member servers as management is done via the server that has been... |
| V-62309 | Medium | The JBoss server must be configured to utilize syslog logging. | Information system logging capability is critical for accurate forensic analysis. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited... |
| V-62215 | Medium | HTTPS must be enabled for JBoss web interfaces. | Encryption is critical for protection of remote access sessions. If encryption is not being used for integrity, malicious users may gain the ability to modify the application server configuration.... |
| V-62259 | Medium | mgmt-users.properties file permissions must be set to allow access to authorized users only. | The mgmt-users.properties file contains the password hashes of all users who are in a management role and must be protected. Application servers have the ability to specify that the hosted... |
| V-62235 | Medium | JBoss must be configured to initiate session logging upon startup. | Session logging activities are developed, integrated, and used in consultation with legal counsel in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations. |
| V-62237 | Medium | JBoss must be configured to log the IP address of the remote system connecting to the JBoss system/cluster. | Information system logging capability is critical for accurate forensic analysis. Without being able to establish what type of event occurred, it would be difficult to establish, correlate, and... |
| V-62341 | Medium | JBoss must be configured to generate log records for all account creations, modifications, disabling, and termination events. | The maintenance of user accounts is a key activity within the system to determine access and privileges. Through changes to accounts, an attacker can create an account for persistent access,... |
| V-62251 | Medium | File permissions must be configured to protect log information from any type of unauthorized read access. | If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve.... |
| V-62335 | Medium | JBoss must be configured to generate log records for privileged activities. | Without generating log records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an... |
| V-62345 | Medium | JBoss servers must be configured to roll over and transfer logs on a minimum weekly basis. | Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Protecting log data is important during a forensic investigation to ensure investigators can... |
| V-62255 | Medium | File permissions must be configured to protect log information from unauthorized deletion. | If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to... |
| V-62323 | Medium | JBoss must be configured to use an approved cryptographic algorithm in conjunction with TLS. | Preventing the disclosure or modification of transmitted information requires that application servers take measures to employ approved cryptography in order to protect the information during... |
| V-62239 | Medium | JBoss must be configured to produce log records containing information to establish what type of events occurred. | Information system logging capability is critical for accurate forensic analysis. Without being able to establish what type of event occurred, it would be difficult to establish, correlate, and... |
| V-62321 | Medium | JBoss must be configured to use an approved TLS version. | Preventing the disclosure of transmitted information requires that the application server take measures to employ some form of cryptographic mechanism in order to protect the information during... |
| V-62253 | Medium | File permissions must be configured to protect log information from unauthorized modification. | If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve.... |
| V-62241 | Medium | JBoss Log Formatter must be configured to produce log records that establish the date and time the events occurred. | Application server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
Ascertaining... |
| V-62243 | Medium | JBoss must be configured to produce log records that establish which hosted application triggered the events. | Application server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
By default,... |
| V-62343 | Medium | The JBoss server must be configured to use DoD- or CNSS-approved PKI Class 3 or Class 4 certificates. | Class 3 PKI certificates are used for servers and software signing rather than for identifying individuals. Class 4 certificates are used for business-to-business transactions. Utilizing... |
| V-62257 | Medium | JBoss log records must be off-loaded onto a different system or system component a minimum of every seven days. | JBoss logs by default are written to the local file system. A centralized logging solution like syslog should be used whenever possible; however, any log data stored to the file system needs to... |
| V-62073 | Medium | HTTP management session traffic must be encrypted. | Types of management interfaces utilized by the JBoss EAP application server include web-based HTTP interfaces as well as command line-based management interfaces. In the event remote HTTP... |
| V-62263 | Medium | Google Analytics must be disabled in EAP Console. | The Google Analytics feature aims to help Red Hat EAP team understand how customers are using the console and which parts of the console matter the most to the customers. This information will, in... |
| V-62319 | Medium | The JBoss server, when hosting mission critical applications, must be in a high-availability (HA) cluster. | A MAC I system is a system that handles data vital to the organization's operational readiness or effectiveness of deployed or contingency forces. A MAC I system must maintain the highest level... |
| V-62269 | Medium | Remote access to JMX subsystem must be disabled. | The JMX subsystem allows you to trigger JDK and application management operations remotely. In a managed domain configuration, the JMX subsystem is removed by default. For a standalone... |
| V-62299 | Medium | JBoss file permissions must be configured to protect the confidentiality and integrity of application files. | The JBoss EAP Application Server is a Java-based AS. It is installed on the OS file system and depends upon file system access controls to protect application data at rest. The file permissions... |
| V-62307 | Medium | The JBoss server must be configured to log all admin activity. | In order to be able to provide a forensic history of activity, the application server must ensure users who are granted a privileged role or those who utilize a separate distinct account when... |
| V-62333 | Medium | JBoss must be configured to generate log records when successful/unsuccessful logon attempts occur. | Logging the access to the application server allows the system administrators to monitor user accounts. By logging successful/unsuccessful logons, the system administrator can determine if an... |
| V-62339 | Medium | JBoss must be configured to generate log records when concurrent logons from different workstations occur to the application server management interface. | Concurrent logons from different systems could possibly indicate a compromised account. When concurrent logons are made from different workstations to the management interface, a log record needs... |
| V-62247 | Medium | The application server must produce log records that contain sufficient information to establish the outcome of events. | Information system logging capability is critical for accurate forensic analysis. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited... |
| V-62287 | Medium | The JBoss Password Vault must be used for storing passwords or other sensitive configuration information. | JBoss EAP 6 has a Password Vault to encrypt sensitive strings, store them in an encrypted keystore, and decrypt them for applications and verification systems. Plain-text configuration files, such... |
| V-62317 | Medium | JBoss must be configured to use DoD PKI-established certificate authorities for verification of the establishment of protected sessions. | Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DoD systems or by organizations with insufficient... |
| V-62315 | Medium | Production JBoss servers must log when successful application deployments occur. | Without logging the enforcement of access restrictions against changes to the application server configuration, it will be difficult to identify attempted attacks, and a log trail will not be... |
| V-62305 | Medium | The application server must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. | Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or... |
| V-62219 | Medium | Users in JBoss Management Security Realms must be in the appropriate role. | Security realms are a series of mappings between users and passwords and users and roles. There are 2 JBoss security realms provided by default; they are "management realm" and "application... |
| V-62331 | Medium | JBoss must be configured to generate log records when successful/unsuccessful attempts to delete privileges occur. | Deleting privileges of a subject/object may cause a subject/object to gain or lose capabilities. When successful and unsuccessful privilege deletions are made, the events need to be logged. By... |
| V-62285 | Medium | JBoss management Interfaces must be integrated with a centralized authentication mechanism that is configured to manage accounts according to DoD policy. | JBoss EAP provides a security realm called ManagementRealm. By default, this realm uses the mgmt-users.properties file for authentication. Using file-based authentication does not allow the... |
| V-62337 | Medium | JBoss must be configured to generate log records that show starting and ending times for access to the application server management interface. | Determining when a user has accessed the management interface is important to determine the timeline of events when a security incident occurs. Generating these events, especially if the... |
| V-62313 | Medium | Production JBoss servers must log when failed application deployments occur. | Without logging the enforcement of access restrictions against changes to the application server configuration, it will be difficult to identify attempted attacks, and a log trail will not be... |
| V-62329 | Medium | JBoss must be configured to generate log records when successful/unsuccessful attempts to modify privileges occur. | Changing privileges of a subject/object may cause a subject/object to gain or lose capabilities. When successful/unsuccessful changes are made, the event needs to be logged. By logging the... |
| V-62271 | Low | Welcome Web Application must be disabled. | The Welcome to JBoss web page provides a redirect to the JBoss admin console, which, by default, runs on TCP 9990 as well as redirects to the Online User Guide and Online User Groups hosted at... |
