OpenControls Logo

STIG Viewer

STIGViewer Support

The MySQL DatabasePassword key must be removed or set to a blank value in the database configuration file in Jamf Pro EMM.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-241803JAMF-10-100120SV-241803r971326_ruleCCI-001813medium
Description
If the database password is not removed or set to a blank value in the configuration file, the user is not forced to enter the password, which would allow an adversary to access to access the database. SFR ID: FMT_SMF.1(2)b. / CM-5(10) Satisfies: SRG-APP-000380
STIGDate
Jamf Pro v10.x EMM Security Technical Implementation Guide2024-08-27

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CHG-04.1Automated Access Enforcement / Auditing
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (50) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(7)Role-based Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00

+40 more (top 10 by confidence shown)

CCI1 mapping
CCI-001813
1.00

Details

Check Text (C-241803r971326_chk)

Verify the MySQL <DatabasePassword> key has been removed or set to a blank value in Jamf Pro EMM. 1. On the Jamf Pro server, navigate to the JSS/Tomcat/webapps/ROOT/WEB-INF/xml. 2. Find the "Database.xml" file and open it in a text editor. 3. Find the <DatabasePassword>. 4. Verify that there is no password. If the MySQL <DatabasePassword> key has not been removed or not set to a blank value, this is a finding.

Fix Text (F-45038r685162_fix)

Remove the MySQL <DatabasePassword> key or set to a blank value in Jamf Pro EMM. If the database password is removed from the configuration file, the database password must be entered manually for the Jamf Pro EMM server web app during startup. In a clustered environment, the database password must be entered manually for each individual node. Note: Default values are included below for reference only. Use unique values in production environments. <Database> ... <DatabaseName>jamfsoftware</DatabaseName> <DatabaseUser>jamfsoftware</DatabaseUser> <DatabasePassword></DatabasePassword> ... </Database>