STIGQter STIGQter: STIG Summary: JBoss EAP 6.3 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 25 Oct 2019: JBoss must utilize encryption when using LDAP for authentication.

DISA Rule

SV-76783r1_rule

Vulnerability Number

V-62293

Group Title

SRG-APP-000172-AS-000121

Rule Version

JBOS-AS-000310

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Follow steps in section 11.8 - Management Interface Security in the JBoss_Enterprise_Application_Platform-6.3-Administration_and_Configuration_Guide-en-US document.

1. Create an outbound connection to the LDAP server.
2. Create an LDAP-enabled security realm.
3. Reference the new security domain in the Management Interface.

Check Contents

Log on to the OS of the JBoss server with OS permissions that allow access to JBoss.
Using the relevant OS commands and syntax, cd to the <JBOSS_HOME>/bin/ folder.
Run the jboss-cli script.
Connect to the server and authenticate.

Run the following command:

For standalone servers:
"ls /socket-binding-group=standard-sockets/remote-destination-outbound-socket-binding=ldap_connection"

For managed domain installations:
"ls /socket-binding-group=<PROFILE>/remote-destination-outbound-socket-binding="

The default port for secure LDAP is 636.

If 636 or secure LDAP protocol is not utilized, this is a finding.

Vulnerability Number

V-62293

Documentable

False

Rule Version

JBOS-AS-000310

Severity Override Guidance

Log on to the OS of the JBoss server with OS permissions that allow access to JBoss.
Using the relevant OS commands and syntax, cd to the <JBOSS_HOME>/bin/ folder.
Run the jboss-cli script.
Connect to the server and authenticate.

Run the following command:

For standalone servers:
"ls /socket-binding-group=standard-sockets/remote-destination-outbound-socket-binding=ldap_connection"

For managed domain installations:
"ls /socket-binding-group=<PROFILE>/remote-destination-outbound-socket-binding="

The default port for secure LDAP is 636.

If 636 or secure LDAP protocol is not utilized, this is a finding.

Check Content Reference

M

Target Key

2923

Comments