JBoss KeyStore and Truststore passwords must not be stored in clear text.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-213531	JBOS-AS-000300	SV-213531r954864_rule		Medium

Description
Access to the JBoss Password Vault must be secured, and the password used to access must be encrypted. There is a specific process used to generate the encrypted password hash. This process must be followed in order to store the password in an encrypted format. The admin must utilize this process in order to ensure the Keystore password is encrypted.

STIG	Date
JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide	2024-02-26

Details

Check Text ( C-14754r296259_chk )
The default location for the keystore used by the JBoss vault is the /vault/ folder. If a vault keystore has been created, by default it will be in the file: /vault/vault.keystore. The file stores a single key, with the default alias vault, which will be used to store encrypted strings, such as passwords, for JBoss EAP. Have the system admin provide the procedure used to encrypt the keystore password that unlocks the keystore. If the system administrator is unable to demonstrate or provide written process documentation on how to encrypt the keystore password, this is a finding.

Check Text ( C-14754r296259_chk )

The default location for the keystore used by the JBoss vault is the /vault/ folder.

If a vault keystore has been created, by default it will be in the file: /vault/vault.keystore. The file stores a single key, with the default alias vault, which will be used to store encrypted strings, such as passwords, for JBoss EAP.

Have the system admin provide the procedure used to encrypt the keystore password that unlocks the keystore.

If the system administrator is unable to demonstrate or provide written process documentation on how to encrypt the keystore password, this is a finding.

Fix Text (F-14752r296260_fix)
Configure the application server to mask the java keystore password as per the procedure described in section 11.13.3 -Password Vault System in the JBoss_Enterprise_Application_Platform-6.3-Administration_and_Configuration_Guide-en-US document.