The Central Administration Web Application must use Kerberos as the authentication provider.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-28119	SHPT-00-000530	SV-36726r2_rule	IAIA-1 IAIA-2	Medium

Description
An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. Techniques used to address this include protocols using nonce's or challenges (e.g., Transport Layer Security (TLS), WS_Security), and time synchronous or challenge-response one-time authenticators.

STIG	Date
SharePoint 2010 Security Technical Implementation Guide (STIG)	2015-10-02

Details

Check Text ( C-37021r2_chk )
1. In SharePoint Central Administration, click Application Management. 2. On the Application Management page, in the Web Applications list, click Manage web applications. 3. On the Web Application Management page, click the Central Administration Web Application, and then click Authentication Providers in the Security section of the ribbon. 4. In the Authentication Providers dialog window, click each Zone and verify if Integrated Windows authentication with Negotiate (Kerberos) are selected in the IIS Authentication Settings section. 5. Mark as not a finding if SharePoint is not used to process sensitive (not public releasable) information. 6. Mark as a finding if Integrated Windows authentication with Negotiate (Kerberos) is not enabled for each zone that processes sensitive (not public releasable) information.

Check Text ( C-37021r2_chk )

1. In SharePoint Central Administration, click Application Management.
2. On the Application Management page, in the Web Applications list, click Manage web applications.
3. On the Web Application Management page, click the Central Administration Web Application, and then click Authentication Providers in the Security section of the ribbon.
4. In the Authentication Providers dialog window, click each Zone and verify if Integrated Windows authentication with Negotiate (Kerberos) are selected in the IIS Authentication Settings section.
5. Mark as not a finding if SharePoint is not used to process sensitive (not public releasable) information.
6. Mark as a finding if Integrated Windows authentication with Negotiate (Kerberos) is not enabled for each zone that processes sensitive (not public releasable) information.

Fix Text (F-32290r2_fix)
Enable Kerberos on the Central Administration Web Application. 1. In SharePoint Central Administration, click Application Management. 2. On the Application Management page, in the Web Applications list, click Manage web applications. 3. On the Web Application Management page, click the Central Administration Web Application, and then click Authentication Providers in the Security section of the ribbon. 4. In the Authentication Providers dialog window, click the associated zone that processes sensitive information (not public releasable) and enable Integrated Windows authentication with Negotiate (Kerberos) and click Save.

Fix Text (F-32290r2_fix)

Enable Kerberos on the Central Administration Web Application.
1. In SharePoint Central Administration, click Application Management.
2. On the Application Management page, in the Web Applications list, click Manage web applications.
3. On the Web Application Management page, click the Central Administration Web Application, and then click Authentication Providers in the Security section of the ribbon.
4. In the Authentication Providers dialog window, click the associated zone that processes sensitive information (not public releasable) and enable Integrated Windows authentication with Negotiate (Kerberos) and click Save.