For environments requiring an Internet-facing capability, the SharePoint application server upon which Central Administration is installed, must not be installed in the DMZ.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-59995	SP13-00-000155	SV-74425r1_rule		Medium

Description
Information flow control regulates where information is allowed to travel within an information system and between information systems (as opposed to who is allowed to access the information) and without explicit regard to subsequent accesses to the information. SharePoint installed Central Administrator is a powerful management tool used to administer the farm. This server should be installed on a trusted network segment. This server should also be used to run services rather than user-oriented web applications.

Description

Information flow control regulates where information is allowed to travel within an information system and between information systems (as opposed to who is allowed to access the information) and without explicit regard to subsequent accesses to the information. SharePoint installed Central Administrator is a powerful management tool used to administer the farm. This server should be installed on a trusted network segment. This server should also be used to run services rather than user-oriented web applications.

STIG	Date
MS SharePoint 2013 Security Technical Implementation Guide	2019-01-08

Details

Check Text ( C-60685r1_chk )
For environments requiring an Internet-facing capability, ensure the SharePoint Central Administration application server is not in the DMZ. Inspect the logical location of the server farm web front end servers. Verify the Central Administration site is not installed on a server located in a DMZ or other publicly accessible segment of the network. If Central Administrator is installed on a publicly facing SharePoint server, this is a finding.

Check Text ( C-60685r1_chk )

For environments requiring an Internet-facing capability, ensure the SharePoint Central Administration application server is not in the DMZ.

Inspect the logical location of the server farm web front end servers.

Verify the Central Administration site is not installed on a server located in a DMZ or other publicly accessible segment of the network.

If Central Administrator is installed on a publicly facing SharePoint server, this is a finding.

Fix Text (F-65405r1_fix)
For environments requiring an Internet-facing capability, remove the SharePoint Central Administration application server upon which Central Administration is installed from the DMZ.