UCF STIG Viewer Logo

The SharePoint Central Administration site must not be accessible from Extranet or Internet connections.


Overview

Finding ID Version Rule ID IA Controls Severity
V-59993 SP13-00-000150 SV-74423r1_rule Medium
Description
SharePoint must prevent the presentation of information system management-related functionality at an interface utilized by general, (i.e., non-privileged), users. The Central Administrator is an application used to manage SharePoint system settings and the settings of the web applications running under SharePoint. The Central Administrator application should both be protected using a defense-in-depth approach. Regular users should not be able to access the Central Administrator as the first line of defense. The second line of defense is regular users do not have user ids defined in the Central Administration application.
STIG Date
MS SharePoint 2013 Security Technical Implementation Guide 2018-04-02

Details

Check Text ( C-60683r2_chk )
Review the SharePoint server configuration to ensure Central Administration site is not accessible from Extranet or Internet connections.

Check outside access to Central Administration.

On an administrative work station, open Central Administration and make note of the URL (i.e., http://sharepointserver:7040).

Try to open the Central Administration application on a regular user's workstation. Open a Web browser and type in the URL to Central Administration.

If the Central Administration can be opened, this is a finding.
Fix Text (F-65403r2_fix)
Configure the SharePoint Central Administration site to not be accessible from Extranet or Internet connections.

Block outside Central Administrator access.

Use an IIS IP address restrictions, firewall, or other filtering solutions to limit access to Central Administration site.