STIGQter: STIG Summary: MarkLogic Server v9 Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 24 Oct 2024:

If MarkLogic Server authentication using passwords is employed, MarkLogic Server must enforce the DOD standards for password complexity and lifetime.

DISA Rule

SV-220364r1018604_rule

Vulnerability Number

V-220364

Group Title

SRG-APP-000164-DB-000401

Rule Version

ML09-00-003600

Severity

CAT II

CCI(s)

• CCI-004066 - For password-based authentication, enforce organization-defined composition and complexity rules.

Weight

10

Fix Recommendation

If the use of passwords is not needed, configure MarkLogic to prevent password use.

If the DBMS can inherit password complexity rules from the operating system or access control program, configure it to do so using one of the following methods:
1. Configure the MarkLogic server to use Kerberos, SAML, or Certificate based authentication.
2. Develop plugin to enforce password complexity. Examples can be found in MarkLogic Application Developers Guide.

Plugins must enforce the following rules for passwords:

a. minimum of 15 characters, including at least one of each of the following character sets:
- Uppercase
- Lowercase
- Numeric
- Special characters (e.g., ~ ! @ # $ % ^ & * ( ) _ + = - ' [ ] / ? > <)
b. Minimum number of characters changed from previous password: 50 percent of the minimum password length (eight)
c. Password lifetime limits for interactive accounts: Minimum 24 hours, maximum 60 days
d. Password lifetime limits for non-interactive accounts: Minimum 24 hours, maximum 365 days
e. Number of password changes before an old one may be reused: Minimum of five

Develop a custom extension that enforces the password complexity and lifetime.
See https://docs.marklogic.com/guide/app-dev/plugins#id_91783

Check Contents

Review MarkLogic settings to see if password authentication is being used, and whether password complexity and lifetime rules are being enforced.

Check for MarkLogic Password Plugin from the MarkLogic Query Console with a user that holds administrative-level privileges.
1. Select "XQuery" in the Query Type drop down and copy the following code into the window:
xquery version "1.0-ml";
import module namespace plugin = "http://marklogic.com/extension/plugin" at "/MarkLogic/plugin/plugin.xqy";

plugin:plugins("http://marklogic.com/xdmp/security/password-check")
2. Run the script. If the script returns "your query returned an empty sequence", then no password plugin is present.
3. If the script returns a file name or file names (e.g., password-check-minimum-length.xqy), then review the file/s in the <MarkLogic Home>/Plugins directory to verify compliance with DOD minimum password requirements.
4. Log in to the MarkLogic Server Admin Interface with a user that holds administrative-level privileges.
5. Click the Groups icon.
6. Click the group in which the App Server to be checked resides (e.g., Default).
7. Click the App Servers icon on the left tree menu.
8. Select each of the App Servers.
9. Inspect the selected authentication method, if "basic", "digestbasic", or "digest" is selected and there is not a custom password plugin, or if the password plugin does not meet DOD minimum requirements, this is a finding.

Vulnerability Number

V-220364

Documentable

False

Rule Version

ML09-00-003600

Severity Override Guidance

Review MarkLogic settings to see if password authentication is being used, and whether password complexity and lifetime rules are being enforced.

Check for MarkLogic Password Plugin from the MarkLogic Query Console with a user that holds administrative-level privileges.
1. Select "XQuery" in the Query Type drop down and copy the following code into the window:
xquery version "1.0-ml";
import module namespace plugin = "http://marklogic.com/extension/plugin" at "/MarkLogic/plugin/plugin.xqy";

plugin:plugins("http://marklogic.com/xdmp/security/password-check")
2. Run the script. If the script returns "your query returned an empty sequence", then no password plugin is present.
3. If the script returns a file name or file names (e.g., password-check-minimum-length.xqy), then review the file/s in the <MarkLogic Home>/Plugins directory to verify compliance with DOD minimum password requirements.
4. Log in to the MarkLogic Server Admin Interface with a user that holds administrative-level privileges.
5. Click the Groups icon.
6. Click the group in which the App Server to be checked resides (e.g., Default).
7. Click the App Servers icon on the left tree menu.
8. Select each of the App Servers.
9. Inspect the selected authentication method, if "basic", "digestbasic", or "digest" is selected and there is not a custom password plugin, or if the password plugin does not meet DOD minimum requirements, this is a finding.

Check Content Reference

M

Target Key

4064