STIGQter: STIG Summary: ArcGIS for Server 10.3 Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 26 Jan 2018:

The ArcGIS Server keystores must only contain certificates of PKI established certificate authorities for verification of protected sessions.

DISA Rule

SV-80009r1_rule

Vulnerability Number

V-65519

Group Title

SRG-APP-000427

Rule Version

AGIS-00-000194

Severity

CAT I

CCI(s)

• CCI-002470 - The information system only allows the use of organization-defined certificate authorities for verification of the establishment of protected sessions.

Weight

10

Fix Recommendation

Configure the ArcGIS Server to only allow the use of DoD PKI established certificate authorities for verification of the establishment of protected sessions. Substitute the target environment’s values for [bracketed] variables.

Use a Java-compatible tool to access the Java keystore at [C:\Program Files\ArcGIS\Server\framework\runtime\jre\lib\security\cacerts].

The password for the keystore is "changeit".

Remove any non-DoD-approved certificates.

Log on to the machine hosting ArcGIS Server. Open Certificate Manager. (You can do this by clicking the "Start" button, then typing "certmgr.msc" into the "Search" box, and pressing the "ENTER" key.)

In the "Certificate Manager" window, click "Trusted Root Certificate Authorities", then click "Certificates".

Remove any non-DoD-approved certificates.

Use a Java-compatible tool to access the Java Keystore at [C:\arcgisserver\config-store\machines\machine_name\arcgis.keystore].

The password is the value of the "password" field within the [C:\arcgisserver\config-store\security\super\super.json] file.

Remove any non-DoD-approved certificates.

Check Contents

Review the ArcGIS Server configuration to ensure the application only allows the use of DoD PKI established certificate authorities for verification of the establishment of protected sessions. Substitute the target environment’s values for [bracketed] variables.

1. Use a Java-compatible tool to access the java keystore at [C:\Program Files\ArcGIS\Server\framework\runtime\jre\lib\security\cacerts].

The password for the keystore is "changeit".

Verify that the Java Keystore [C:\Program Files\ArcGIS\Server\framework\runtime\jre\lib\security\cacerts] does not contain any non-DoD-approved certificates.

If any non-DoD-approved certificate authorities are listed as trusted, this is a finding.

2. Log on to the machine hosting ArcGIS Server. Open Certificate Manager. (You can do this by clicking the "Start" button, typing "certmgr.msc" into the "Search" box, and pressing the "ENTER" key.)

In the "Certificate Manager" window, click "Trusted Root Certificate Authorities", then click" Certificates".

Verify that the Windows Keystore does not contain any non-DoD-approved certificates.

If any non-DoD-approved certificate authorities are listed as trusted, this is a finding.

3. Use a Java-compatible tool to access the Java Keystore at [C:\arcgisserver\config-store\machines\machine_name\arcgis.keystore].

The password is the value of the "password" field within the [C:\arcgisserver\config-store\security\super\super.json] file.

Verify that the Java Keystore [C:\arcgisserver\config-store\machines\machine_name\arcgis.keystore] does not contain any non-DoD-approved certificates.

If any non-DoD-approved certificate authorities are listed as trusted, this is a finding.

Vulnerability Number

V-65519

Documentable

False

Rule Version

AGIS-00-000194

Severity Override Guidance

Review the ArcGIS Server configuration to ensure the application only allows the use of DoD PKI established certificate authorities for verification of the establishment of protected sessions. Substitute the target environment’s values for [bracketed] variables.

1. Use a Java-compatible tool to access the java keystore at [C:\Program Files\ArcGIS\Server\framework\runtime\jre\lib\security\cacerts].

The password for the keystore is "changeit".

Verify that the Java Keystore [C:\Program Files\ArcGIS\Server\framework\runtime\jre\lib\security\cacerts] does not contain any non-DoD-approved certificates.

If any non-DoD-approved certificate authorities are listed as trusted, this is a finding.

2. Log on to the machine hosting ArcGIS Server. Open Certificate Manager. (You can do this by clicking the "Start" button, typing "certmgr.msc" into the "Search" box, and pressing the "ENTER" key.)

In the "Certificate Manager" window, click "Trusted Root Certificate Authorities", then click" Certificates".

Verify that the Windows Keystore does not contain any non-DoD-approved certificates.

If any non-DoD-approved certificate authorities are listed as trusted, this is a finding.

3. Use a Java-compatible tool to access the Java Keystore at [C:\arcgisserver\config-store\machines\machine_name\arcgis.keystore].

The password is the value of the "password" field within the [C:\arcgisserver\config-store\security\super\super.json] file.

Verify that the Java Keystore [C:\arcgisserver\config-store\machines\machine_name\arcgis.keystore] does not contain any non-DoD-approved certificates.

If any non-DoD-approved certificate authorities are listed as trusted, this is a finding.

Check Content Reference

M

Target Key

2961

Comments