Best practices and references used for hardening JBoss.
Stigviewer
| id | severity | EAP 6.3 settings |
| V-62217 | high | Java permissions must be set for hosted applications. |
| V-62221 | high | Silent Authentication must be removed from the Default Application Security Realm. |
| V-62223 | high | Silent Authentication must be removed from the Default Management Security Realm. |
| V-62225 | high | The Java Security Manager must be enabled for the JBoss application server. |
| V-62227 | high | The JBoss server must be configured with Role Based Access Controls. |
| V-62229 | high | JBoss management interfaces must be secured. |
| V-62261 | high | JBoss process owner interactive access must be restricted. |
| V-62265 | high | JBoss process owner execution permissions must be limited. |
| V-62325 | high | Production JBoss servers must be supported by the vendor. |
| V-62327 | high | The JRE installed on the JBoss server must be kept up to date. |
| V-62073 | medium | HTTP management session traffic must be encrypted. |
| V-62215 | medium | HTTPS must be enabled for JBoss web interfaces. |
| V-62219 | medium | Users in JBoss Management Security Realms must be in the appropriate role. |
| V-62231 | medium | The JBoss server must generate log records for access and authentication events to the management interface. |
| V-62233 | medium | JBoss must be configured to allow only the ISSM (or individuals or roles appointed by the ISSM) to select which loggable events are to be logged. |
| V-62235 | medium | JBoss must be configured to initiate session logging upon startup. |
| V-62237 | medium | JBoss must be configured to log the IP address of the remote system connecting to the JBoss system/cluster. |
| V-62239 | medium | JBoss must be configured to produce log records containing information to establish what type of events occurred. |
| V-62241 | medium | JBoss Log Formatter must be configured to produce log records that establish the date and time the events occurred. |
| V-62243 | medium | JBoss must be configured to produce log records that establish which hosted application triggered the events. |
| V-62245 | medium | JBoss must be configured to record the IP address and port information used by management interface network traffic. |
| V-62247 | medium | The application server must produce log records that contain sufficient information to establish the outcome of events. |
| V-62249 | medium | JBoss ROOT logger must be configured to utilize the appropriate logging level. |
| V-62251 | medium | File permissions must be configured to protect log information from any type of unauthorized read access. |
| V-62253 | medium | File permissions must be configured to protect log information from unauthorized modification. |
| V-62255 | medium | File permissions must be configured to protect log information from unauthorized deletion. |
| V-62257 | medium | JBoss log records must be off-loaded onto a different system or system component a minimum of every seven days. |
| V-62259 | medium | mgmt-users.properties file permissions must be set to allow access to authorized users only. |
| V-62263 | medium | Google Analytics must be disabled in EAP Console. |
| V-62267 | medium | JBoss QuickStarts must be removed. |
| V-62269 | medium | Remote access to JMX subsystem must be disabled. |
| V-62273 | medium | Any unapproved applications must be removed. |
| V-62275 | medium | JBoss application and management ports must be approved by the PPSM CAL. |
| V-62277 | medium | The JBoss Server must be configured to utilize a centralized authentication mechanism such as AD or LDAP. |
| V-62279 | medium | The JBoss Server must be configured to use certificates to authenticate admins. |
| V-62281 | medium | The JBoss server must be configured to use individual accounts and not generic or shared accounts. |
| V-62283 | medium | The JBoss server must be configured to bind the management interfaces to only management networks. |
| V-62285 | medium | JBoss management Interfaces must be integrated with a centralized authentication mechanism that is configured to manage accounts according to DoD policy. |
| V-62287 | medium | The JBoss Password Vault must be used for storing passwords or other sensitive configuration information. |
| V-62289 | medium | JBoss KeyStore and Truststore passwords must not be stored in clear text. |
| V-62291 | medium | LDAP enabled security realm value allow-empty-passwords must be set to false. |
| V-62293 | medium | JBoss must utilize encryption when using LDAP for authentication. |
| V-62295 | medium | The JBoss server must be configured to restrict access to the web servers private key to authenticated system administrators. |
| V-62297 | medium | The JBoss server must separate hosted application functionality from application server management functionality. |
| V-62299 | medium | JBoss file permissions must be configured to protect the confidentiality and integrity of application files. |
| V-62301 | medium | Access to JBoss log files must be restricted to authorized users. |
| V-62303 | medium | Network access to HTTP management must be disabled on domain-enabled application servers not designated as the domain controller. |
| V-62305 | medium | The application server must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. |
| V-62307 | medium | The JBoss server must be configured to log all admin activity. |
| V-62309 | medium | The JBoss server must be configured to utilize syslog logging. |
| V-62311 | medium | Production JBoss servers must not allow automatic application deployment. |
| V-62313 | medium | Production JBoss servers must log when failed application deployments occur. |
| V-62315 | medium | Production JBoss servers must log when successful application deployments occur. |
| V-62317 | medium | JBoss must be configured to use DoD PKI-established certificate authorities for verification of the establishment of protected sessions. |
| V-62319 | medium | The JBoss server, when hosting mission critical applications, must be in a high-availability (HA) cluster. |
| V-62321 | medium | JBoss must be configured to use an approved TLS version. |
| V-62323 | medium | JBoss must be configured to use an approved cryptographic algorithm in conjunction with TLS. |
| V-62329 | medium | JBoss must be configured to generate log records when successful/unsuccessful attempts to modify privileges occur. |
| V-62331 | medium | JBoss must be configured to generate log records when successful/unsuccessful attempts to delete privileges occur. |
| V-62333 | medium | JBoss must be configured to generate log records when successful/unsuccessful logon attempts occur. |
| V-62335 | medium | JBoss must be configured to generate log records for privileged activities. |
| V-62337 | medium | JBoss must be configured to generate log records that show starting and ending times for access to the application server management interface. |
| V-62339 | medium | JBoss must be configured to generate log records when concurrent logons from different workstations occur to the application server management interface. |
| V-62341 | medium | JBoss must be configured to generate log records for all account creations, modifications, disabling, and termination events. |
| V-62343 | medium | The JBoss server must be configured to use DoD- or CNSS-approved PKI Class 3 or Class 4 certificates. |
| V-62345 | medium | JBoss servers must be configured to roll over and transfer logs on a minimum weekly basis. |
| V-62271 | low | Welcome Web Application must be disabled. |
Security Configuration Guides
- Known vulnerabilities: CVE Details
- Available Exploits: Exploit-DB
- Vulners