The OHS password(s) must be entrusted to the OHS Administrator.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-64653	OH12-1X-000207	SV-79143r1_rule		Medium

Description
Normally, a service account is established for OHS. This is because a privileged account is not desirable and the server is designed to run for long uninterrupted periods of time. The SA or Web Manager will need password access to OHS to restart the service in the event of an emergency as OHS is not to restart automatically after an unscheduled interruption. If the password is not entrusted to an SA or web manager the ability to ensure the availability of OHS is compromised.

Description

Normally, a service account is established for OHS. This is because a privileged account is not desirable and the server is designed to run for long uninterrupted periods of time. The SA or Web Manager will need password access to OHS to restart the service in the event of an emergency as OHS is not to restart automatically after an unscheduled interruption. If the password is not entrusted to an SA or web manager the ability to ensure the availability of OHS is compromised.

STIG	Date
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide	2017-09-12

Details

Check Text ( C-65395r1_chk )
1. Ask the OHS Administrator if they know the password to the OS account that owns the OHS software. 2. If they do not, this is a finding.

Fix Text (F-70583r1_fix)
Inform the OHS Administrator as to what the password is for the OS account that owns the OHS Software.