STIGQter: STIG Summary: SPEC Innovations Innoslate 4.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 08 Sep 2022:

Innoslate must use multifactor authentication for network access to privileged and non-privileged accounts.

DISA Rule

SV-254093r845255_rule

Vulnerability Number

V-254093

Group Title

SRG-APP-000149

Rule Version

SPEC-IN-000280

Severity

CAT I

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
• CCI-000186 - For public key-based authentication, enforce authorized access to the corresponding private key.
• CCI-000765 - Implement multifactor authentication for network access to privileged accounts.
• CCI-001953 - Accepts Personal Identity Verification-compliant credentials.
• CCI-001954 - Electronically verifies Personal Identity Verification-compliant credentials.
• CCI-002009 - Accept Personal Identity Verification-compliant credentials from other federal agencies.
• CCI-002010 - Electronically verify Personal Identity Verification-compliant credentials from other federal agencies.
• CCI-002130 - Automatically audit account enabling actions.
• CCI-002145 - Enforce organization-defined circumstances and/or usage conditions for organization-defined system accounts.
• CCI-002361 - Automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.
• CCI-002470 - Only allow the use of organization-defined certificate authorities for verification of the establishment of protected sessions.

Weight

10

Fix Recommendation

1. Enter settings.properties file.
2. Change the AUTHENTICATION_TYPE to "CAC".
3. Save.
4. Restart the Innoslate service.

Check Contents

1. Enter the settings.properties file located at C:\Innoslate4\apache-tomcat\webapps\Innoslate4\WEB-INF.
2. Find the LDAP fields.
3. Verify LDAP information is correct. If not, this is a finding.

The LDAP Fields should look (not exactly) like this:

"
LDAP_INITIAL_CONTEXT_FACTORY = com.sun.jndi.ldap.LdapCtxFactory
LDAP_PROVIDER_URLS = ldap://providerUrl.com
LDAP_SECURITY_AUTHENTICATION = none
LDAP_SECURITY_PRINCIPAL = CN=Admin Innoslate,CN=Users,DC=Innoslateactive,DC=com
LDAP_SECURITY_CREDENTIALS = password
LDAP_USER_CONTEXT = CN=Users,DC=Innoslateactive,DC=com
LDAP_USER_OBJECT_CLASS = user
LDAP_USER_UID_ATTRIBUTE = sAMAccountName
LDAP_CONNECT_TIMEOUT = 1000
LDAP_READ_TIMEOUT = 5000
LDAP_USER_EMAIL_ATTRIBUTE = mail
LDAP_USER_FIRST_NAME_ATTRIBUTE = givenName
LDAP_USER_LAST_NAME_ATTRIBUTE = sn
LDAP_USER_PHONE_NUMBER_ATTRIBUTE = telephoneNumber
LDAP_USER_COMPANY_ATTRIBUTE = company
LDAP_USER_SEARCH_FILTER = (&(objectClass=user)(sAMAccountName={0})(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
"

Vulnerability Number

V-254093

Documentable

False

Rule Version

SPEC-IN-000280

Severity Override Guidance

1. Enter the settings.properties file located at C:\Innoslate4\apache-tomcat\webapps\Innoslate4\WEB-INF.
2. Find the LDAP fields.
3. Verify LDAP information is correct. If not, this is a finding.

The LDAP Fields should look (not exactly) like this:

"
LDAP_INITIAL_CONTEXT_FACTORY = com.sun.jndi.ldap.LdapCtxFactory
LDAP_PROVIDER_URLS = ldap://providerUrl.com
LDAP_SECURITY_AUTHENTICATION = none
LDAP_SECURITY_PRINCIPAL = CN=Admin Innoslate,CN=Users,DC=Innoslateactive,DC=com
LDAP_SECURITY_CREDENTIALS = password
LDAP_USER_CONTEXT = CN=Users,DC=Innoslateactive,DC=com
LDAP_USER_OBJECT_CLASS = user
LDAP_USER_UID_ATTRIBUTE = sAMAccountName
LDAP_CONNECT_TIMEOUT = 1000
LDAP_READ_TIMEOUT = 5000
LDAP_USER_EMAIL_ATTRIBUTE = mail
LDAP_USER_FIRST_NAME_ATTRIBUTE = givenName
LDAP_USER_LAST_NAME_ATTRIBUTE = sn
LDAP_USER_PHONE_NUMBER_ATTRIBUTE = telephoneNumber
LDAP_USER_COMPANY_ATTRIBUTE = company
LDAP_USER_SEARCH_FILTER = (&(objectClass=user)(sAMAccountName={0})(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
"

Check Content Reference

M

Target Key

5481