documentation_complete: true

title: 'Enable the JBoss Keystore'

description: |-
    Configure the application server to use the java keystore and JBoss vault as
    per section 11.13.1 -Password Vault System in the
    JBoss_Enterprise_Application_Platform-6.3
    -Administration_and_Configuration_Guide-en-US document.
    <br /><br />
    1. Create a java keystore.
    2. Mask the keystore password and initialize the password vault.
    3. Configure JBoss to use the password vault.

rationale: |-
    JBoss EAP 6 has a Password Vault to encrypt sensitive strings, store them in an
    encrypted keystore, and decrypt them for applications and verification systems.
    Plain-text configuration files, such as XML deployment descriptors, need to
    specify passwords and other sensitive information. Use the JBoss EAP Password
    Vault to securely store sensitive strings in plain-text files.

severity: medium

identifiers:
    cce: 80478-1

references:
    disa: 196
    nist: ""
    srg: SRG-APP-000171-AS-000119
    stigid: JBOS-AS-000295

ocil_clause: 'it is not'

ocil: |-
    Log on to the OS of the JBoss server with OS permissions that allow access to
    JBoss.
    Using the relevant OS commands and syntax, cd to the <tt>&lt;JBOSS_HOME&gt;/bin/</tt>
    folder.
    Run the <pre>jboss-cli</pre> script.
    Connect to the server and authenticate.
    Run the command:
    <br /><br />
    <pre>ls /core-service=vault</pre>
    <br /><br />
    If <pre>code=undefined</pre> and <pre>module=undefined</pre>,
    this is a finding.
