documentation_complete: true

title: 'Log Application Deployments'

description: |-
    Launch the jboss-cli management interface substituting standalone or domain for
    <i>CONFIG</i> based upon the server installation.
    <br /><br />
    <pre>&lt;JBOSS_HOME&gt;/<i>CONFIG</i>/bin/jboss-cli</pre>
    <br /><br />
    connect to the server and run the following command:
    <br /><br />
    <pre>/core-service=management/access=audit/logger=audit-log:write-attribute(name=enabled,value=true)</pre>

rationale: |-
    Without logging the enforcement of access restrictions against changes to the
    application server configuration, it will be difficult to identify attempted
    attacks, and a log trail will not be available for forensic investigation for
    after-the-fact actions. Configuration changes may occur to any of the modules
    within the application server through the management interface, but logging of
    actions to the configuration of a module outside the application server is not
    logged.
    <br /><br />
    Enforcement actions are the methods or mechanisms used to prevent
    unauthorized changes to configuration settings. Enforcement action methods may
    be as simple as denying access to a file based on the application of file
    permissions (access restriction). Log items may consist of lists of actions
    blocked by access restrictions or changes identified after the fact.

severity: medium

identifiers:
    cce: 80490-6

references:
    disa: 1814
    nist: ""
    srg: SRG-APP-000381-AS-000089
    stigid: JBOS-AS-000550

ocil_clause: 'it is not'

ocil: |-
    Log on to the OS of the JBoss server with OS permissions that allow access to
    JBoss.
    Using the relevant OS commands and syntax, cd to the <tt>&lt;JBOSS_HOME&gt;/bin/</tt>
    folder.
    Run the <pre>jboss-cli</pre> script.
    Connect to the server and authenticate.
    Run the command:
    <br /><br />
    <pre>ls /core-service=management/access=audit/logger=audit-log</pre>
    <br /><br />
    If <pre>"enabled" =.</pre>, this is a finding.
