2 - Remove or Disable Example Content - enable-welcome-root

Information

Although it can be a good idea to keep some example content in a test environment, to check if the server is running correctly, it is not a good practice in production.

Removing the samples will prevent an external client seeing what version of the AS you are running and will also prevent the AS instance being affected by future security bugs on this content.

Solution

Disable or remove the welcome-content directory by placing "false" as a value on enable-welcome-root

<virtual-server name="default-host" enable-welcome-root="false">

See Also

https://docs.jboss.org/author/display/AS72/Hardening+Guidelines

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b.

Plugin: Unix

Control ID: 3a7c0d509a0cd3565a4a829f60fc46cb414827fcbc41c98562305c633064ebaf