| Checked | Name | Title |
|---|
| ☐ | SV-213494r960759_rule | HTTP management session traffic must be encrypted. |
| ☐ | SV-213495r960762_rule | HTTPS must be enabled for JBoss web interfaces. |
| ☐ | SV-213496r1069472_rule | Java permissions must be set for hosted applications. |
| ☐ | SV-213497r1069475_rule | The Java Security Manager must be enabled for the JBoss application server. |
| ☐ | SV-213498r1028281_rule | The JBoss server must be configured with Role Based Access Controls. |
| ☐ | SV-213499r960792_rule | Users in JBoss Management Security Realms must be in the appropriate role. |
| ☐ | SV-213500r960792_rule | Silent Authentication must be removed from the Default Application Security Realm. |
| ☐ | SV-213501r960792_rule | Silent Authentication must be removed from the Default Management Security Realm. |
| ☐ | SV-213502r960792_rule | JBoss management interfaces must be secured. |
| ☐ | SV-213503r1028283_rule | The JBoss server must generate log records for access and authentication events to the management interface. |
| ☐ | SV-213504r960882_rule | JBoss must be configured to allow only the ISSM (or individuals or roles appointed by the ISSM) to select which loggable events are to be logged. |
| ☐ | SV-213505r960888_rule | JBoss must be configured to initiate session logging upon startup. |
| ☐ | SV-213506r960891_rule | JBoss must be configured to log the IP address of the remote system connecting to the JBoss system/cluster. |
| ☐ | SV-213507r960891_rule | JBoss must be configured to produce log records containing information to establish what type of events occurred. |
| ☐ | SV-213508r960894_rule | JBoss Log Formatter must be configured to produce log records that establish the date and time the events occurred. |
| ☐ | SV-213509r960897_rule | JBoss must be configured to produce log records that establish which hosted application triggered the events. |
| ☐ | SV-213510r960900_rule | JBoss must be configured to record the IP address and port information used by management interface network traffic. |
| ☐ | SV-213511r960903_rule | The application server must produce log records that contain sufficient information to establish the outcome of events. |
| ☐ | SV-213512r960906_rule | JBoss ROOT logger must be configured to utilize the appropriate logging level. |
| ☐ | SV-213513r960930_rule | File permissions must be configured to protect log information from any type of unauthorized read access. |
| ☐ | SV-213514r960933_rule | File permissions must be configured to protect log information from unauthorized modification. |
| ☐ | SV-213515r960936_rule | File permissions must be configured to protect log information from unauthorized deletion. |
| ☐ | SV-213516r960948_rule | JBoss log records must be off-loaded onto a different system or system component a minimum of every seven days. |
| ☐ | SV-213517r960960_rule | mgmt-users.properties file permissions must be set to allow access to authorized users only. |
| ☐ | SV-213518r960963_rule | JBoss process owner interactive access must be restricted. |
| ☐ | SV-213519r960963_rule | Google Analytics must be disabled in EAP Console. |
| ☐ | SV-213520r960963_rule | JBoss process owner execution permissions must be limited. |
| ☐ | SV-213521r960963_rule | JBoss QuickStarts must be removed. |
| ☐ | SV-213522r960963_rule | Remote access to JMX subsystem must be disabled. |
| ☐ | SV-213523r960963_rule | Welcome Web Application must be disabled. |
| ☐ | SV-213524r960963_rule | Any unapproved applications must be removed. |
| ☐ | SV-213525r1043177_rule | JBoss application and management ports must be approved by the PPSM CAL. |
| ☐ | SV-213526r1051118_rule | The JBoss Server must be configured to utilize a centralized authentication mechanism such as AD or LDAP. |
| ☐ | SV-213527r960972_rule | The JBoss Server must be configured to use certificates to authenticate admins. |
| ☐ | SV-213528r981680_rule | The JBoss server must be configured to use individual accounts and not generic or shared accounts. |
| ☐ | SV-213529r981681_rule | JBoss management Interfaces must be integrated with a centralized authentication mechanism that is configured to manage accounts according to DoD policy. |
| ☐ | SV-213530r981682_rule | The JBoss Password Vault must be used for storing passwords or other sensitive configuration information. |
| ☐ | SV-213531r981682_rule | JBoss KeyStore and Truststore passwords must not be stored in clear text. |
| ☐ | SV-213532r961029_rule | LDAP enabled security realm value allow-empty-passwords must be set to false. |
| ☐ | SV-213533r961029_rule | JBoss must utilize encryption when using LDAP for authentication. |
| ☐ | SV-213534r961041_rule | The JBoss server must be configured to restrict access to the web servers private key to authenticated system administrators. |
| ☐ | SV-213535r961095_rule | The JBoss server must separate hosted application functionality from application server management functionality. |
| ☐ | SV-213536r961128_rule | JBoss file permissions must be configured to protect the confidentiality and integrity of application files. |
| ☐ | SV-213537r961170_rule | Access to JBoss log files must be restricted to authorized users. |
| ☐ | SV-213538r961281_rule | Network access to HTTP management must be disabled on domain-enabled application servers not designated as the domain controller. |
| ☐ | SV-213539r961353_rule | The application server must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. |
| ☐ | SV-213540r961362_rule | The JBoss server must be configured to log all admin activity. |
| ☐ | SV-213541r961395_rule | The JBoss server must be configured to utilize syslog logging. |
| ☐ | SV-213542r961461_rule | Production JBoss servers must not allow automatic application deployment. |
| ☐ | SV-213543r981687_rule | Production JBoss servers must log when failed application deployments occur. |
| ☐ | SV-213544r981687_rule | Production JBoss servers must log when successful application deployments occur. |
| ☐ | SV-213545r961596_rule | JBoss must be configured to use DoD PKI-established certificate authorities for verification of the establishment of protected sessions. |
| ☐ | SV-213546r961620_rule | The JBoss server, when hosting mission critical applications, must be in a high-availability (HA) cluster. |
| ☐ | SV-213547r961632_rule | JBoss must be configured to use an approved TLS version. |
| ☐ | SV-213548r961635_rule | JBoss must be configured to use an approved cryptographic algorithm in conjunction with TLS. |
| ☐ | SV-213549r961683_rule | Production JBoss servers must be supported by the vendor. |
| ☐ | SV-213550r961683_rule | The JRE installed on the JBoss server must be kept up to date. |
| ☐ | SV-213551r961800_rule | JBoss must be configured to generate log records when successful/unsuccessful attempts to modify privileges occur. |
| ☐ | SV-213552r961812_rule | JBoss must be configured to generate log records when successful/unsuccessful attempts to delete privileges occur. |
| ☐ | SV-213553r961824_rule | JBoss must be configured to generate log records when successful/unsuccessful logon attempts occur. |
| ☐ | SV-213554r961827_rule | JBoss must be configured to generate log records for privileged activities. |
| ☐ | SV-213555r961830_rule | JBoss must be configured to generate log records that show starting and ending times for access to the application server management interface. |
| ☐ | SV-213556r961833_rule | JBoss must be configured to generate log records when concurrent logons from different workstations occur to the application server management interface. |
| ☐ | SV-213557r961842_rule | JBoss must be configured to generate log records for all account creations, modifications, disabling, and termination events. |
| ☐ | SV-213558r961857_rule | The JBoss server must be configured to use DoD- or CNSS-approved PKI Class 3 or Class 4 certificates. |
| ☐ | SV-213559r961860_rule | JBoss servers must be configured to roll over and transfer logs on a minimum weekly basis. |
| ☐ | SV-217099r961863_rule | The JBoss server must be configured to bind the management interfaces to only management networks. |
STIGQter: STIG Summary: