JBoss process owner interactive access must be restricted.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-213518 | JBOS-AS-000220 | SV-213518r960963_rule | CCI-000381 | high |
| Description | ||||
| JBoss does not require admin rights to operate and should be run as a regular user. In addition, if the user account was to be compromised and the account was allowed interactive logon rights, this would increase the risk and attack surface against the JBoss system. The right to interactively log on to the system using the JBoss account should be limited according to the OS capabilities. | ||||
| STIG | Date | |||
| JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide | 2025-02-20 | |||
Related Frameworks
3 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-7
1.00
- DISA · V2R6 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1711 mapping
3.4.6
1.00
- DISA · V2R6 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000381
1.00
- DISA · V2R6 · disa_xccdf · related
Details
Check Text (C-213518r960963_chk)
Identify the user account used to run the JBoss server. Use relevant OS commands to determine logon rights to the system. This account should not have full shell/interactive access to the system.
If the user account used to operate JBoss can log on interactively, this is a finding.
Fix Text (F-14739r296221_fix)
Use the relevant OS commands to restrict JBoss user account from interactively logging on to the console of the JBoss system.
For Windows systems, use GPO.
For UNIX like systems using ssh DenyUsers <account id> or follow established procedure for restricting access.