documentation_complete: true

title: 'Restrict Access to the JBoss Keystore'

description: |-
    Configure the application server OS file permissions on the corresponding
    private key to restrict access to authorized accounts or roles.

rationale: |-
    The cornerstone of the PKI is the private key used to encrypt or digitally sign
    information.
    <br /><br />
    If the private key is stolen, this will lead to the compromise of
    the authentication and non-repudiation gained through PKI because the attacker
    can use the private key to digitally sign documents and can pretend to be the
    authorized user.
    <br /><br />
    Both the holders of a digital certificate and the issuing
    authority must protect the computers, storage devices, or whatever they use to
    keep the private keys. Java-based application servers utilize the Java keystore,
    which provides storage for cryptographic keys and certificates. The keystore is
    usually maintained in a file stored on the file system.

severity: medium

identifiers:
    cce: 80482-3

references:
    disa: 186
    nist: ""
    srg: SRG-APP-000176-AS-000125
    stigid: JBOS-AS-000320

ocil_clause: 'it is not'

ocil: |-
    The default location for the keystore used by the JBoss vault is the
    <tt>&lt;JBOSS_HOME&gt;/vault/</tt> folder.
    <br /><br />
    If a vault keystore has been created, by default it
    will be in the file: <tt>&lt;JBOSS_HOME&gt;/vault/vault.keystore</tt>. The file stores a
    single key, with the default alias vault, which will be used to store encrypted
    strings, such as passwords, for JBoss EAP.
    <br /><br />
    Browse to the JBoss vault folder
    using the relevant OS commands.
    Review the file permissions and ensure only
    system administrators and JBoss users are allowed access.
    <br /><br />
    Owner can be full access. Group can be full access.
    All others must be restricted to execute access
    or no permission.
    <br /><br />
    If non-system administrators are allowed to access the
    <tt>&lt;JBOSS_HOME&gt;/vault/</tt>
    folder, this is a finding.
