JBOS-AS-000220 - JBoss process owner interactive access must be restricted.

Information

JBoss does not require admin rights to operate and should be run as a regular user. In addition, if the user account was to be compromised and the account was allowed interactive logon rights, this would increase the risk and attack surface against the JBoss system. The right to interactively log on to the system using the JBoss account should be limited according to the OS capabilities.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Use the relevant OS commands to restrict JBoss user account from interactively logging on to the console of the JBoss system.

For Windows systems, use GPO.

For UNIX like systems using ssh DenyUsers <account id> or follow established procedure for restricting access.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_JBoss_EAP_6-3_V2R4_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7a., CAT|I, CCI|CCI-000381, Rule-ID|SV-213518r954822_rule, STIG-ID|JBOS-AS-000220, STIG-Legacy|SV-76751, STIG-Legacy|V-62261, Vuln-ID|V-213518

Plugin: Unix

Control ID: 57c41ad139ae0a2cdc811a5e3744a07aefa334e499cf90283479287bad9c2050