Network access to HTTP management must be disabled on domain-enabled application servers not designated as the domain controller.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-213538	SRG-APP-000316-AS-000199	JBOS-AS-000470	SV-213538r961281_rule	2025-02-20	2

Description
When configuring JBoss application servers into a domain configuration, HTTP management capabilities are not required on domain member servers as management is done via the server that has been designated as the domain controller. Leaving HTTP management capabilities enabled on domain member servers increases the attack surfaces; therefore, management services on domain member servers must be disabled and management services performed via the domain controller.

Description

When configuring JBoss application servers into a domain configuration, HTTP management capabilities are not required on domain member servers as management is done via the server that has been designated as the domain controller. Leaving HTTP management capabilities enabled on domain member servers increases the attack surfaces; therefore, management services on domain member servers must be disabled and management services performed via the domain controller.

ℹ️ Check
Log on to each of the JBoss domain member servers. Note: Sites that manage systems using the JBoss Operations Network client require HTTP interface access. It is acceptable that the management console alone be disabled rather than disabling the entire interface itself. Run the <JBOSS_HOME>/bin/jboss-cli command line interface utility and connect to the JBoss server. Run the following command: ls /core-service=management/management-interface=httpinterface/ If "console-enabled=true", this is a finding.

ℹ️ Check

Log on to each of the JBoss domain member servers. Note: Sites that manage systems using the JBoss Operations Network client require HTTP interface access. It is acceptable that the management console alone be disabled rather than disabling the entire interface itself. Run the <JBOSS_HOME>/bin/jboss-cli command line interface utility and connect to the JBoss server. Run the following command: ls /core-service=management/management-interface=httpinterface/ If "console-enabled=true", this is a finding.

✔️ Fix
Run the <JBOSS_HOME>/bin/jboss-cli command line interface utility. Connect to the JBoss server and run the following command. /core-service=management/management-interface=httpinterface/:write-attribute(name=console-enabled,value=false) Successful command execution returns {"outcome" => "success"}, and future attempts to access the management console via web browser at <SERVERNAME>:9990 will result in no access to the admin console.

✔️ Fix

Run the <JBOSS_HOME>/bin/jboss-cli command line interface utility. Connect to the JBoss server and run the following command. /core-service=management/management-interface=httpinterface/:write-attribute(name=console-enabled,value=false) Successful command execution returns {"outcome" => "success"}, and future attempts to access the management console via web browser at <SERVERNAME>:9990 will result in no access to the admin console.