Title

The Manager Web app password must be configured as follows: -15 or more characters. -at least one lower case letter. -at least one upper case letter. -at least one number. -at least one special character. (Cat II impact)

Discussion

The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password. Satisfies: SRG-APP-000164, SRG-APP-000166, SRG-APP-000169

Check Content

Verify the Manager Web app password has been configured as follows: -15 or more characters. -at least one lower case letter. -at least one upper case letter. -at least one number. -at least one special character. Log in to the ISEC7 SPHERE server. Open a Web browser and go to https://localhost/manager/html. Log in with the custom administrator login and password. Verify password entered meets complexity requirements. If the Manager Web app password has not been configured as required, this is a finding.

Fix Text

To set a strong password on the Manager Web app, run the ISEC7 integrated installer or use the following manual procedure: Log in to the ISEC7 SPHERE server. Browse to <Drive>:\Program Files\ISEC7 SPHERE\Tomcat\conf and open Tomcat-Users.xml. Open the Command Prompt and CD to <Drive>:\Program Files\ISEC7 SPHERE\Tomcat\bin. Execute the following using sha command: digest –a sha password* *Where password is the 15 character password designated for the account. Copy the output, which is the hashed digest password. In Tomcat-Users.xml, add in the password for the user with the obfuscated output at <user password="**", where ** is the obfuscated password. example: <user password="310c55aa3d5b42217e7f0e80ce30467d$100000$529cceb1fbc80f4f461fc1bd56219d79d9c94d4a8fc46abad0646f27e753ff9e" roles="manager-gui,manager-script" username="admin"/> Save the file. Open <Drive>:\Program Files\ISEC7 SPHERE\Tomcat\conf\server.xml with Notepad.exe. Enter: <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase" digest=”sha”/> Save the file. Restart the ISEC7 SPHERE Web service using the services.msc. Note: the password must meet the following complexity requirements: -15 or more characters. -at least one lower case letter. -at least one upper case letter. -at least one number. -at least one special character.

Additional Identifiers

Rule ID: SV-224785r1013867_rule

Vulnerability ID: V-224785

Group Title: SRG-APP-000164

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.