Title

The JBoss server must be configured to use individual accounts and not generic or shared accounts. (Cat II impact)

Discussion

To assure individual accountability and prevent unauthorized access, application server users (and any processes acting on behalf of application server users) must be individually identified and authenticated. A group authenticator is a generic account used by multiple individuals. Use of a group authenticator alone does not uniquely identify individual users. Application servers must ensure that individual users are authenticated prior to authenticating via role or group authentication. This is to ensure that there is non-repudiation for actions taken.

Check Content

If the application server management interface is configured to use LDAP authentication this requirement is NA. Determine the mode in which the JBoss server is operating by authenticating to the OS, changing to the <JBOSS_HOME>/bin/ folder and executing the jboss-cli script. Connect to the server and authenticate. Run the command: "ls" and examine the "launch-type" setting. User account information is stored in the following files for a JBoss server configured in standalone mode. The command line flags passed to the "standalone" startup script determine the standalone operating mode: <JBOSS_HOME>/standalone/configuration/standalone.xml <JBOSS_HOME>/standalone/configuration/standalone-full.xml <JBOSS_HOME>/standalone/configuration/standalone.-full-ha.xml <JBOSS_HOME>/standalone/configuration/standalone.ha.xml For a Managed Domain: <JBOSS_HOME>/domain/configuration/domain.xml. Review file(s) for generic or shared user accounts. Open each xml file with a text editor and locate the <management-interfaces> section. Review the <user name = "xxxxx"> sub-section where "xxxxx" will be a user name. Have the system administrator identify the user of each user account. If user accounts are not assigned to individual users, this is a finding.

Fix Text

Configure the application server so required users are individually authenticated by creating individual user accounts. Utilize an LDAP server that is configured according to DOD policy.

Additional Identifiers

Rule ID: SV-213528r956002_rule

Vulnerability ID: V-213528

Group Title: SRG-APP-000153-AS-000104

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.