documentation_complete: true

title: 'Use Secure Standard LDAP Port'

description: |-
    Follow steps in section 11.8 - Management Interface Security in the
    JBoss_Enterprise_Application_Platform-6.3
    -Administration_and_Configuration_Guide-en-US document.
    <br /><br />
    1. Create an outbound connection to the LDAP server.
    2. Create an LDAP-enabled security realm.
    3. Reference the new security domain in the Management Interface.

rationale: |-
    Passwords need to be protected at all times, and encryption is the standard
    method for protecting passwords during transmission.
    <br /><br />
    Application servers have
    the capability to utilize LDAP directories for authentication. If LDAP
    connections are not protected during transmission, sensitive authentication
    credentials can be stolen. When the application server utilizes LDAP, the LDAP
    traffic must be encrypted.

severity: medium

identifiers:
    cce: 80481-5

references:
    disa: 197
    nist: ""
    srg: SRG-APP-000172-AS-000121
    stigid: JBOS-AS-000310

ocil_clause: 'it is not'

ocil: |-
    Log on to the OS of the JBoss server with OS permissions that allow access to
    JBoss.
    Using the relevant OS commands and syntax, cd to the <tt>&lt;JBOSS_HOME&gt;/bin/</tt>
    folder.
    Run the <pre>jboss-cli</pre> script.
    Connect to the server and authenticate.
    <br /><br />
    Run the following command:
    <br /><br />
    For standalone servers:
    <pre>ls /socket-binding-group=standard-sockets/remote-destination-outbound-socket-binding=ldap_connection</pre>
    <br /><br />
    For managed domain installations:
    <pre>ls /socket-binding-group=<i>PROFILE</i>/remote-destination-outbound-socket-binding=</pre>
    <br /><br />
    The default port for secure LDAP is 636.
    <br /><br />
    If 636 or secure LDAP protocol is not utilized, this is a finding.
