The Central Administration Web Application must use Kerberos as the authentication provider.

From MS SharePoint 2010 Security Technical Implementation Guide

Part of SRG-APP-000156-COL-000112

Associated with: CCI-001941

SV-36726r2_rule The Central Administration Web Application must use Kerberos as the authentication provider.

Vulnerability discussion

An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. Techniques used to address this include protocols using nonce's or challenges (e.g., Transport Layer Security (TLS), WS_Security), and time synchronous or challenge-response one-time authenticators.

Check content

1. In SharePoint Central Administration, click Application Management. 2. On the Application Management page, in the Web Applications list, click Manage web applications. 3. On the Web Application Management page, click the Central Administration Web Application, and then click Authentication Providers in the Security section of the ribbon. 4. In the Authentication Providers dialog window, click each Zone and verify if Integrated Windows authentication with Negotiate (Kerberos) are selected in the IIS Authentication Settings section. 5. Mark as not a finding if SharePoint is not used to process sensitive (not public releasable) information. 6. Mark as a finding if Integrated Windows authentication with Negotiate (Kerberos) is not enabled for each zone that processes sensitive (not public releasable) information.

Fix text

Enable Kerberos on the Central Administration Web Application. 1. In SharePoint Central Administration, click Application Management. 2. On the Application Management page, in the Web Applications list, click Manage web applications. 3. On the Web Application Management page, click the Central Administration Web Application, and then click Authentication Providers in the Security section of the ribbon. 4. In the Authentication Providers dialog window, click the associated zone that processes sensitive information (not public releasable) and enable Integrated Windows authentication with Negotiate (Kerberos) and click Save.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer