← Back to JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide

V-213538

CAT II (Medium)

Network access to HTTP management must be disabled on domain-enabled application servers not designated as the domain controller.

Rule ID

SV-213538r961281_rule

STIG

JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide

Version

V2R6

CCIs

CCI-002322

Discussion

When configuring JBoss application servers into a domain configuration, HTTP management capabilities are not required on domain member servers as management is done via the server that has been designated as the domain controller. Leaving HTTP management capabilities enabled on domain member servers increases the attack surfaces; therefore, management services on domain member servers must be disabled and management services performed via the domain controller.

Check Content

Log on to each of the JBoss domain member servers.

Note: Sites that manage systems using the JBoss Operations Network client require HTTP interface access.  It is acceptable that the management console alone be disabled rather than disabling the entire interface itself.

Run the <JBOSS_HOME>/bin/jboss-cli command line interface utility and connect to the JBoss server.
Run the following command:
ls /core-service=management/management-interface=httpinterface/

If "console-enabled=true", this is a finding.

Fix Text

Run the <JBOSS_HOME>/bin/jboss-cli command line interface utility. 
Connect to the JBoss server and run the following command.
/core-service=management/management-interface=httpinterface/:write-attribute(name=console-enabled,value=false)

Successful command execution returns
{"outcome" => "success"}, and future attempts to access the management console via web browser at <SERVERNAME>:9990 will result in no access to the admin console.