Title

The web server service password(s) must be entrusted to the SA or Web Manager. (Cat II impact)

Discussion

Normally, a service account is established for the web server. This is because a privileged account is not desirable and the server is designed to run for long uninterrupted periods of time. The SA or Web Manager will need password access to the web server to restart the service in the event of an emergency as the web server is not to restart automatically after an unscheduled interruption. If the password is not entrusted to an SA or web manager the ability to ensure the availability of the web server is compromised.

Check Content

The reviewer should make a note of the name of the account being used for the web service. NOTE: There may also be other server services running related to the web server in support of a particular web application, these passwords must be entrusted to the SA or Web Manager as well. Query the SA or Web Manager to determine if they have the web service password(s). If the web services password(s) are not entrusted to the SA or Web Manager, this is a finding. NOTE: For IIS installations that use the LocalSystem account, the password is OS generated. In this case, the SA or Web Manager having an Admin account on the system would meet the intent of this check.

Fix Text

Ensure the SA or Web Manager is entrusted with the web service(s) password.

Additional Identifiers

Rule ID: SV-38188r1_rule

Vulnerability ID: V-2232

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.