JBOS-AS-000285 - The JBoss server must be configured to bind the management interfaces to only management networks.

Information

JBoss provides multiple interfaces for accessing the system. By default, these are called 'public' and 'management'. Allowing non-management traffic to access the JBoss management interface increases the chances of a security compromise. The JBoss server must be configured to bind the management interface to a network that controls access. This is usually a network that has been designated as a management network and has restricted access. Similarly, the public interface must be bound to a network that is not on the same segment as the management interface.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Refer to Section 4.9 of the JBoss EAP 6.3 Installation guide for detailed instructions on how to start JBoss as a service.

Use the following command line parameters to assign the management interface to a specific management network.

These command line flags must be added both when starting JBoss as a service and when starting from the command line.

Substitute your actual network address for the 10.x.x.x addresses provided as an example below.

For a standalone configuration:
JBOSS_HOME/bin/standalone.sh -bmanagement=10.2.2.1 -b 10.1.1.1

JBOSS_HOME/bin/domain.sh -bmanagement=10.2.2.1 -b 10.1.1.1

If a management network is not available, you may substitute localhost/127.0.0.1 for management address. This will force you to manage the JBoss server from the local host.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_JBoss_EAP_6-3_V2R4_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-6b., 800-53|IA-3, CAT|II, CCI|CCI-000366, CCI|CCI-000778, Rule-ID|SV-217099r955845_rule, STIG-ID|JBOS-AS-000285, STIG-Legacy|SV-76773, STIG-Legacy|V-62283, Vuln-ID|V-217099

Plugin: Unix

Control ID: 5027c33588321d3a1c4b7d8353267d429f864996eb55db56cf47acd36ba6cfee