UCF STIG Viewer Logo

The JBoss server must be configured to use individual accounts and not generic or shared accounts.


Overview

Finding ID Version Rule ID IA Controls Severity
V-213528 JBOS-AS-000275 SV-213528r615939_rule Medium
Description
To assure individual accountability and prevent unauthorized access, application server users (and any processes acting on behalf of application server users) must be individually identified and authenticated. A group authenticator is a generic account used by multiple individuals. Use of a group authenticator alone does not uniquely identify individual users. Application servers must ensure that individual users are authenticated prior to authenticating via role or group authentication. This is to ensure that there is non-repudiation for actions taken.
STIG Date
JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide 2021-11-23

Details

Check Text ( C-14751r296250_chk )
If the application server management interface is configured to use LDAP authentication this requirement is NA.

Determine the mode in which the JBoss server is operating by authenticating to the OS, changing to the /bin/ folder and executing the jboss-cli script.
Connect to the server and authenticate.
Run the command: "ls" and examine the "launch-type" setting.

User account information is stored in the following files for a JBoss server configured in standalone mode. The command line flags passed to the "standalone" startup script determine the standalone operating mode:
/standalone/configuration/standalone.xml
/standalone/configuration/standalone-full.xml
/standalone/configuration/standalone.-full-ha.xml
/standalone/configuration/standalone.ha.xml

For a Managed Domain:
/domain/configuration/domain.xml.

Review both files for generic or shared user accounts.

Open each xml file with a text editor and locate the section.
Review the sub-section where "xxxxx" will be a user name.

Have the system administrator identify the user of each user account.

If user accounts are not assigned to individual users, this is a finding.
Fix Text (F-14749r296251_fix)
Configure the application server so required users are individually authenticated by creating individual user accounts. Utilize an LDAP server that is configured according to DOD policy.