STIGQter: STIG Summary: ArcGIS for Server 10.3 Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 26 Jan 2018:

The ArcGIS Server must use Windows authentication to enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

DISA Rule

SV-79875r2_rule

Vulnerability Number

V-65385

Group Title

SRG-APP-000033

Rule Version

AGIS-00-000016

Severity

CAT I

CCI(s)

• CCI-000166 - The information system protects against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
• CCI-000186 - The information system, for PKI-based authentication, enforces authorized access to the corresponding private key.
• CCI-000187 - The information system, for PKI-based authentication, maps the authenticated identity to the account of the individual or group.
• CCI-000197 - The information system, for password-based authentication, transmits only cryptographically-protected passwords.
• CCI-000206 - The information system obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.
• CCI-000213 - The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
• CCI-000764 - The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).
• CCI-000765 - The information system implements multifactor authentication for network access to privileged accounts.
• CCI-000766 - The information system implements multifactor authentication for network access to non-privileged accounts.
• CCI-000767 - The information system implements multifactor authentication for local access to privileged accounts.
• CCI-000768 - The information system implements multifactor authentication for local access to non-privileged accounts.
• CCI-000770 - The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed.
• CCI-000778 - The information system uniquely identifies an organization-defined list of specific and/or types of devices before establishing a local, remote, or network connection.
• CCI-000795 - The organization manages information system identifiers by disabling the identifier after an organization-defined time period of inactivity.
• CCI-000804 - The information system uniquely identifies and authenticates non-organizational users (or processes acting on behalf of non-organizational users).
• CCI-001133 - The information system terminates the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.
• CCI-001185 - The information system invalidates session identifiers upon user logout or other session termination.
• CCI-001368 - The information system enforces approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure ArcGIS for Server to ensure that the application enforces approved authorizations for logical access to information system resources. Substitute the target environment’s values for [bracketed] variables.

Identify a system that will serve as the service endpoint for the ArcGIS for Server environment. This must be an Active Directory joined Windows 2008 R2 system with IIS 7.5 or later installed. If a Web Application Firewall (WAF), and/or Load Balancer serves as the user-connection endpoint, this system must be deployed on a trusted network behind these front-end technologies. On this system (locally), perform the following steps:

Install the “ArcGIS Web Adaptor”.'
Configure the “ArcGIS Web Adaptor” such that “Administration” is enabled via the Web Adaptor.

Enable Active Directory Client Certificate Authentication "To map client certificates by using Active Directory mapping."

Configure ArcGIS for Server to utilize Windows Users and Roles:

Navigate to ArcGIS Server Manager ([https://server.domain.com/arcgis]/manager). (logon when prompted.)
Navigate to the “Security” tab.
Navigate to the “Settings” sub-tab.
Edit “Configuration Settings” by clicking on the pencil icon.

Select “Users and roles from an existing enterprise system (LDAP or Windows Domain)”, then click “Next”.
Select “Windows Domain”, then click “Next”.

Supply Active Directory credentials with privileges “Logon To” the system on which ArcGIS for Server is deployed, then click “Next”.

Select “Web Tier” as the “Authentication Tier”, then click “Next” >> “Finish”.

On the system that hosts the ArcGIS Web Adaptor, open IIS Manager.

Select “[arcgis]” application >> SSL Settings >> Check “Require SSL” and “Require Client Certificates” >> Apply.

Check Contents

Review the ArcGIS for Server configuration to ensure that the application enforces approved authorizations for logical access to information system resources.

Substitute the target environment’s values for [bracketed] variables.

Navigate to [https://server.domain.com/arcgis]/admin/security/config (logon when prompted.)

Verify the "User Store Configuration" value = "Type: Windows".
If the "User Store Configuration" value is set to "Type: Built-In", this is a finding.

Verify the "Role Store Configuration" value = "Type: Windows".

If the "Role store Configuration" value is set to "Type: Built-In", this is a finding.

Verify the "Authentication Tier" value is set to "WEB_ADAPTOR".
If the "Authentication Tier" value is set to "GIS_SERVER", this is a finding.

Open IIS Manager on the system that hosts the ArcGIS Web Adaptor.
Select the "[arcgis]" application.
Open "SSL Settings".
Verify the "Client Certificates" property is set to "Require".

If the "Client Certificates" property is not set to "Require", this is a finding.

This test requires the account performing the check to have "Administrator" privilege to the ArcGIS for Server site. This check can be performed remotely via HTTPS. This configuration is only valid when ArcGIS for Server has been deployed onto a Windows 2008 or later operating system that is a member of an Active Directory domain.

This control is not applicable for ArcGIS Server deployments configured to allow anonymous access.

This control is not applicable for ArcGIS Server deployments which are integrated with and protected by one or more third party DoD-compliant certificate authentication solutions.

Vulnerability Number

V-65385

Documentable

False

Rule Version

AGIS-00-000016

Severity Override Guidance

Review the ArcGIS for Server configuration to ensure that the application enforces approved authorizations for logical access to information system resources.

Substitute the target environment’s values for [bracketed] variables.

Navigate to [https://server.domain.com/arcgis]/admin/security/config (logon when prompted.)

Verify the "User Store Configuration" value = "Type: Windows".
If the "User Store Configuration" value is set to "Type: Built-In", this is a finding.

Verify the "Role Store Configuration" value = "Type: Windows".

If the "Role store Configuration" value is set to "Type: Built-In", this is a finding.

Verify the "Authentication Tier" value is set to "WEB_ADAPTOR".
If the "Authentication Tier" value is set to "GIS_SERVER", this is a finding.

Open IIS Manager on the system that hosts the ArcGIS Web Adaptor.
Select the "[arcgis]" application.
Open "SSL Settings".
Verify the "Client Certificates" property is set to "Require".

If the "Client Certificates" property is not set to "Require", this is a finding.

This test requires the account performing the check to have "Administrator" privilege to the ArcGIS for Server site. This check can be performed remotely via HTTPS. This configuration is only valid when ArcGIS for Server has been deployed onto a Windows 2008 or later operating system that is a member of an Active Directory domain.

This control is not applicable for ArcGIS Server deployments configured to allow anonymous access.

This control is not applicable for ArcGIS Server deployments which are integrated with and protected by one or more third party DoD-compliant certificate authentication solutions.

Check Content Reference

M

Target Key

2961

Comments