The JBoss Server must be configured to use certificates to authenticate admins.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-62279	JBOS-AS-000265	SV-76769r1_rule		Medium

Description
Multifactor authentication creates a layered defense and makes it more difficult for an unauthorized person to access the application server. If one factor is compromised or broken, the attacker still has at least one more barrier to breach before successfully breaking into the target. Unlike a simple username/password scenario where the attacker could gain access by knowing both the username and password without the user knowing his account was compromised, multifactor authentication adds the requirement that the attacker must have something from the user, such as a token, or to biometrically be the user. Multifactor authentication is defined as: using two or more factors to achieve authentication. Factors include: (i) something a user knows (e.g., password/PIN); (ii) something a user has (e.g., cryptographic identification device, token); or (iii) something a user is (e.g., biometric). A CAC or PKI Hardware Token meets this definition. A privileged account is defined as an information system account with authorizations of a privileged user. These accounts would be capable of accessing the web management interface. When accessing the application server via a network connection, administrative access to the application server must be PKI Hardware Token enabled or a DoD-approved soft certificate.

Description

Multifactor authentication creates a layered defense and makes it more difficult for an unauthorized person to access the application server. If one factor is compromised or broken, the attacker still has at least one more barrier to breach before successfully breaking into the target. Unlike a simple username/password scenario where the attacker could gain access by knowing both the username and password without the user knowing his account was compromised, multifactor authentication adds the requirement that the attacker must have something from the user, such as a token, or to biometrically be the user. Multifactor authentication is defined as: using two or more factors to achieve authentication. Factors include: (i) something a user knows (e.g., password/PIN); (ii) something a user has (e.g., cryptographic identification device, token); or (iii) something a user is (e.g., biometric). A CAC or PKI Hardware Token meets this definition. A privileged account is defined as an information system account with authorizations of a privileged user. These accounts would be capable of accessing the web management interface. When accessing the application server via a network connection, administrative access to the application server must be PKI Hardware Token enabled or a DoD-approved soft certificate.

STIG	Date
JBoss EAP 6.3 Security Technical Implementation Guide	2017-03-20

Details

Check Text ( C-63083r1_chk )
Log on to the OS of the JBoss server with OS permissions that allow access to JBoss. Using the relevant OS commands and syntax, cd to the /bin/ folder. Run the jboss-cli script. Connect to the server and authenticate. Follow these steps: 1. Identify the security realm assigned to the management interfaces by using the following command: For standalone systems: "ls /core-service=management/management-interface=" For managed domain systems: "ls /host=master/core-service=management/management-interface=" Document the name of the security-realm associated with each management interface. 2. Review the security realm using the command: For standalone systems: "ls /core-service=management/security-realm=/authentication" For managed domains: "ls /host=master/core-service=management/security-realm=/authentication" If the command in step 2 does not return a security realm that uses certificates for authentication, this is a finding.

Check Text ( C-63083r1_chk )

Log on to the OS of the JBoss server with OS permissions that allow access to JBoss.
Using the relevant OS commands and syntax, cd to the /bin/ folder.
Run the jboss-cli script.
Connect to the server and authenticate.

Follow these steps:
1. Identify the security realm assigned to the management interfaces by using the following command:

For standalone systems:
"ls /core-service=management/management-interface="

For managed domain systems:
"ls /host=master/core-service=management/management-interface="

Document the name of the security-realm associated with each management interface.

2. Review the security realm using the command:

For standalone systems:
"ls /core-service=management/security-realm=/authentication"

For managed domains:
"ls /host=master/core-service=management/security-realm=/authentication"

If the command in step 2 does not return a security realm that uses certificates for authentication, this is a finding.

Fix Text (F-68199r1_fix)
Configure the application server to authenticate privileged users via multifactor/certificate-based authentication mechanisms when using network access to the management interface.