STIGQter: STIG Summary: JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

HTTP management session traffic must be encrypted.

DISA Rule

SV-213494r615939_rule

Vulnerability Number

V-213494

Group Title

SRG-APP-000014-AS-000009

Rule Version

JBOS-AS-000010

Severity

CAT II

CCI(s)

CCI-000068 - The information system implements cryptographic mechanisms to protect the confidentiality of remote access sessions.

Weight

Fix Recommendation

Follow the specific instructions in the Red Hat Security Guide for EAP version 6.3 to configure the management console for HTTPS.

This involves the following steps.
1. Create a keystore in JKS format.
2. Ensure the management console binds to HTTPS.
3. Create a new Security Realm.
4. Configure Management Interface to use new security realm.
5. Configure the management console to use the keystore.
6. Restart the EAP server.

Check Contents

Log on to the OS of the JBoss server with OS permissions that allow access to JBoss. Using the relevant OS commands and syntax, cd to the <JBOSS_HOME>/bin/ folder.
Run the jboss-cli script. Connect to the server and authenticate.

For a standalone configuration run the following command:
"ls /core-service=management/management-interface=http-interface"

If "secure-socket-binding"=undefined, this is a finding.

For a domain configuration run the following command:
"ls /host=master/core-service=management/management-interface=http-interface"

If "secure-port" is undefined, this is a finding.

HTTP management session traffic must be encrypted.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key

Comments