documentation_complete: true

title: 'Enable HTTPS for JBoss Web Interface'

description: |-
    Follow procedure "4.4. Configure the JBoss Web Server to use HTTPS."
    The detailed procedure is found in the JBoss EAP 6.3 Security Guide available at
    the vendor's site, RedHat.com. An overview of steps is provided here.
    <br /><br />
    1. Obtain or generate DoD-approved SSL certificates.
    2. Configure the SSL certificate using your certificate values.
    3. Set the SSL protocol to TLS V1.1 or V1.2.

rationale: |-
    Encryption is critical for protection of remote access sessions. If encryption
    is not being used for integrity, malicious users may gain the ability to modify
    the application server configuration. The use of cryptography for ensuring
    integrity of remote access sessions mitigates that risk.
    <br /><br />
    Application servers
    utilize a web management interface and scripted commands when allowing remote
    access. Web access requires the use of TLS, and scripted access requires using
    ssh or some other form of approved cryptography. Application servers must have a
    capability to enable a secure remote admin capability.
    <br /><br />
    FIPS 140-2 approved TLS
    versions include TLS V1.0 or greater.
    <br /><br />
    FIPS 140-2 approved TLS versions must be
    enabled, and non-FIPS-approved SSL versions must be disabled.
    <br /><br />
    NIST SP 800-52
    specifies the preferred configurations for government systems.

severity: medium

identifiers:
    cce: 80451-8

references:
    disa: 1453
    nist: ""
    srg: SRG-APP-000015-AS-000010
    stigid: JBOS-AS-000015

ocil_clause: 'it is not'

ocil: |-
    Log on to the OS of the JBoss server with OS permissions that allow access to
    JBoss.
    <br /><br />
    Using the relevant OS commands and syntax, cd to the
    <tt>&lt;JBOSS_HOME&gt;/bin/</tt> folder
    Run the <pre>jboss-cli</pre> script.
    Connect to the server and authenticate.
    Review the web subsystem and ensure that HTTPS is enabled.
    Run the command:
    <br /><br />
    For a managed domain:
    <pre>ls /profile=<i>PROFILE_NAME</i>/subsystem=web/connector=</pre>
    For a standalone system:
    <pre>ls /subsystem=web/connector=</pre>
    <br /><br />
    If <tt>https</tt> is not returned, this is a finding.
