The JBoss server must be configured to use individual accounts and not generic or shared accounts.

To assure individual accountability and prevent unauthorized access, application server users (and any processes acting on behalf of application server users) must be individually identified and authenticated.A group authenticator is a generic account used by multiple individuals. Use of a group authenticator alone does not uniquely identify individual users.Application servers must ensure that individual users are authenticated prior to authenticating via role or group authentication. This is to ensure that there is non-repudiation for actions taken.

Check content

If the application server management interface is configured to use LDAP authentication this requirement is NA. Determine the mode in which the JBoss server is operating by authenticating to the OS, changing to the /bin/ folder and executing the jboss-cli script. Connect to the server and authenticate. Run the command: "ls" and examine the "launch-type" setting. User account information is stored in the following files for a JBoss server configured in standalone mode. The command line flags passed to the "standalone" startup script determine the standalone operating mode: /standalone/configuration/standalone.xml /standalone/configuration/standalone-full.xml /standalone/configuration/standalone.-full-ha.xml /standalone/configuration/standalone.ha.xml For a Managed Domain: /domain/configuration/domain.xml. Review both files for generic or shared user accounts. Open each xml file with a text editor and locate the section. Review the sub-section where "xxxxx" will be a user name. Have the system administrator identify the user of each user account. If user accounts are not assigned to individual users, this is a finding.

Fix text

Configure the application server so required users are individually authenticated by creating individual user accounts. Utilize an LDAP server that is configured according to DOD policy.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

SV-76771r1_rule The JBoss server must be configured to use individual accounts and not generic or shared accounts.

Vulnerability discussion

Check content

Fix text

Pro Tips