STIGQter: STIG Summary: JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

LDAP enabled security realm value allow-empty-passwords must be set to false.

DISA Rule

SV-213532r615939_rule

Vulnerability Number

V-213532

Group Title

SRG-APP-000172-AS-000120

Rule Version

JBOS-AS-000305

Severity

CAT II

CCI(s)

• CCI-000197 - The information system, for password-based authentication, transmits only cryptographically-protected passwords.

Weight

10

Fix Recommendation

Configure the LDAP Security Realm using default settings that sets "allow-empty-values" to false. LDAP Security Realm creation is described in section 11.9 -Add an LDAP Security Realm in the JBoss_Enterprise_Application_Platform-6.3-Administration_and_Configuration_Guide-en-US document.

Check Contents

Log on to the OS of the JBoss server with OS permissions that allow access to JBoss.
Using the relevant OS commands and syntax, cd to the <JBOSS_HOME>/bin/ folder.
Run the jboss-cli script.
Connect to the server and authenticate.
Run the command:

"ls /core-service=management/security-realm=ldap_security_realm/authentication=ldap"

If "allow-empty-passwords=true", this is a finding.

Vulnerability Number

V-213532

Documentable

False

Rule Version

JBOS-AS-000305

Severity Override Guidance

Log on to the OS of the JBoss server with OS permissions that allow access to JBoss.
Using the relevant OS commands and syntax, cd to the <JBOSS_HOME>/bin/ folder.
Run the jboss-cli script.
Connect to the server and authenticate.
Run the command:

"ls /core-service=management/security-realm=ldap_security_realm/authentication=ldap"

If "allow-empty-passwords=true", this is a finding.

Check Content Reference

M

Target Key

3987

Comments