STIGQter: STIG Summary: JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

The JBoss server must be configured to bind the management interfaces to only management networks.

DISA Rule

SV-217099r615939_rule

Vulnerability Number

V-217099

Group Title

SRG-APP-000516-AS-000237

Rule Version

JBOS-AS-000285

Severity

CAT II

CCI(s)

• CCI-000778 - The information system uniquely identifies an organization-defined list of specific and/or types of devices before establishing a local, remote, or network connection.
• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Refer to Section 4.9 of the JBoss EAP 6.3 Installation guide for detailed instructions on how to start JBoss as a service.

Use the following command line parameters to assign the management interface to a specific management network.

These command line flags must be added both when starting JBoss as a service and when starting from the command line.

Substitute your actual network address for the 10.x.x.x addresses provided as an example below.

For a standalone configuration:
JBOSS_HOME/bin/standalone.sh -bmanagement=10.2.2.1 -b 10.1.1.1

JBOSS_HOME/bin/domain.sh -bmanagement=10.2.2.1 -b 10.1.1.1

If a management network is not available, you may substitute localhost/127.0.0.1 for management address. This will force you to manage the JBoss server from the local host.

Check Contents

Obtain documentation and network drawings from system admin that shows the network interfaces on the JBoss server and the networks they are configured for.

If a management network is not used, you may substitute localhost/127.0.0.1 for management address. If localhost/127.0.0.1 is used for management interface, this is not a finding.

From the JBoss server open the web-based admin console by pointing a browser to HTTP://127.0.0.1:9990.
Log on to the management console with admin credentials.
Select "RUNTIME".
Expand STATUS by clicking on +.
Expand PLATFORM by clicking on +.
In the "Environment" tab, click the > arrow until you see the "jboss.bind.properties" and the "jboss.bind.properties.management" values.

If the jboss.bind.properties and the jboss.bind.properties.management do not have different IP network addresses assigned, this is a finding.

Review the network documentation. If access to the management IP address is not restricted, this is a finding.

Vulnerability Number

V-217099

Documentable

False

Rule Version

JBOS-AS-000285

Severity Override Guidance

Obtain documentation and network drawings from system admin that shows the network interfaces on the JBoss server and the networks they are configured for.

If a management network is not used, you may substitute localhost/127.0.0.1 for management address. If localhost/127.0.0.1 is used for management interface, this is not a finding.

From the JBoss server open the web-based admin console by pointing a browser to HTTP://127.0.0.1:9990.
Log on to the management console with admin credentials.
Select "RUNTIME".
Expand STATUS by clicking on +.
Expand PLATFORM by clicking on +.
In the "Environment" tab, click the > arrow until you see the "jboss.bind.properties" and the "jboss.bind.properties.management" values.

If the jboss.bind.properties and the jboss.bind.properties.management do not have different IP network addresses assigned, this is a finding.

Review the network documentation. If access to the management IP address is not restricted, this is a finding.

Check Content Reference

M

Target Key

3987

Comments