JBOS-AS-000470 - Network access to HTTP management must be disabled on domain-enabled application servers not designated as the domain controller.

Information

When configuring JBoss application servers into a domain configuration, HTTP management capabilities are not required on domain member servers as management is done via the server that has been designated as the domain controller.

Leaving HTTP management capabilities enabled on domain member servers increases the attack surfaces; therefore, management services on domain member servers must be disabled and management services performed via the domain controller.

Solution

Run the <JBOSS_HOME>/bin/jboss-cli command line interface utility.
Connect to the JBoss server and run the following command.
/core-service=management/management-interface=httpinterface/:write-attribute(name=console-enabled,value=false)

Successful command execution returns
{'outcome' => 'success'}, and future attempts to access the management console via web browser at <SERVERNAME>:9990 will result in no access to the admin console.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_JBoss_EAP_6-3_V2R4_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-17(9), CAT|II, CCI|CCI-002322, Rule-ID|SV-213538r955034_rule, STIG-ID|JBOS-AS-000470, STIG-Legacy|SV-76793, STIG-Legacy|V-62303, Vuln-ID|V-213538

Plugin: Unix

Control ID: 3aa43627748903e0dba37dadbed021eab93a5f007cfe476f4c8fcd43cf5472f5