documentation_complete: true

title: 'Encrypt JBoss Keystore Passwords'

description: |-
    Configure the application server to mask the java keystore password as per the
    procedure described in section 11.13.3 -Password Vault System in the
    JBoss_Enterprise_Application_Platform-6.3
    -Administration_and_Configuration_Guide-en-US document.

rationale: |-
    Access to the JBoss Password Vault must be secured, and the password used to
    access must be encrypted. There is a specific process used to generate the
    encrypted password hash. This process must be followed in order to store the
    password in an encrypted format.
    <br /><br />
    The admin must utilize this process in order
    to ensure the Keystore password is encrypted.

severity: medium

identifiers:
    cce: 80479-9

references:
    disa: 196
    nist: ""
    srg: SRG-APP-000171-AS-000119
    stigid: JBOS-AS-000300

ocil_clause: 'it is not'

ocil: |-
    The default location for the keystore used by the JBoss vault is the
    <tt>&lt;JBOSS_HOME&gt;/vault/</tt> folder.
    <br /><br />
    If a vault keystore has been created, by default it
    will be in the file: <tt>&lt;JBOSS_HOME&gt;/vault/vault.keystore</tt>. The file stores a
    single key, with the default alias vault, which will be used to store encrypted
    strings, such as passwords, for JBoss EAP.
    <br /><br />
    Have the system admin provide the
    procedure used to encrypt the keystore password that unlocks the keystore.
    <br /><br />
    If
    the system administrator is unable to demonstrate or provide written process
    documentation on how to encrypt the keystore password, this is a finding.
