Oracle WebLogic must separate hosted application functionality from Oracle WebLogic management functionality.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-235983	WBLC-08-000222	SV-235983r628727_rule		Medium

Description
Application server management functionality includes functions necessary to administer the application server and requires privileged access via one of the accounts assigned to a management role. The separation of application server administration functionality from hosted application functionality is either physical or logical and is accomplished by using different computers, different central processing units, different instances of the operating system, network addresses, network ports, or combinations of these methods, as appropriate.

Description

Application server management functionality includes functions necessary to administer the application server and requires privileged access via one of the accounts assigned to a management role. The separation of application server administration functionality from hosted application functionality is either physical or logical and is accomplished by using different computers, different central processing units, different instances of the operating system, network addresses, network ports, or combinations of these methods, as appropriate.

STIG	Date
Oracle WebLogic Server 12c Security Technical Implementation Guide	2021-03-18

Details

Check Text ( C-39202r628725_chk )
1. Access AC 2. From 'Domain Structure', select 'Environment' -> 'Servers' 3. A single server in the list will be named 'Admin Server' and this is the server which hosts AS management functionality, such as the AdminConsole application 4. All remaining servers in the list are 'Managed Servers' and these are the individual or clustered servers which will host the actual applications 5. Ensure no applications are deployed on the Admin server, rather, only on the Managed servers If any applications are deployed on the Admin server, this is a finding.

Check Text ( C-39202r628725_chk )

Fix Text (F-39165r628726_fix)
1. Access AC 2. From 'Domain Structure', select 'Environment' -> 'Servers' 3. A single server in the list will be named 'Admin Server' and this is the server which hosts AS management functionality, such as the AdminConsole application 4. All remaining servers in the list are 'Managed Servers' and these are the individual or clustered servers which will host the actual applications 5. Utilize 'Change Center' to create a new change session 6. Undeploy all applications that are not used for AS management from the Admin server, and redeploy onto the Managed servers 7. This can be done from 'Deployments' tab -> 'Targets' tab; select each application which must be redeployed , deselect 'Admin Server' and select one or more of the Managed servers 8. Click 'Save' and restart servers if necessary

Fix Text (F-39165r628726_fix)

1. Access AC
2. From 'Domain Structure', select 'Environment' -> 'Servers'
3. A single server in the list will be named 'Admin Server' and this is the server which hosts AS management functionality, such as the AdminConsole application
4. All remaining servers in the list are 'Managed Servers' and these are the individual or clustered servers which will host the actual applications
5. Utilize 'Change Center' to create a new change session
6. Undeploy all applications that are not used for AS management from the Admin server, and redeploy onto the Managed servers
7. This can be done from 'Deployments' tab -> 'Targets' tab; select each application which must be redeployed , deselect 'Admin Server' and select one or more of the Managed servers
8. Click 'Save' and restart servers if necessary