Detections
Analytics

8.1 Ensure 'authentication' is set to 'true' to protect the metrics end point

Information

Protect access to the metrics end point in the MicroProfile feature so that only valid users are allowed to access it.

Enabling authentication for the metrics end point will ensure that only authenticated users can access it.

Solution

Ensure that the authentication attribute of the mpMetrics element is set to true in the ${server.config.dir}/configDropins/overrides/<any file name>.xml

<mpMetrics authentication="true"/>

See Also

https://workbench.cisecurity.org/benchmarks/7724

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: a7058c39996a968be322d614c1b772707731810aea88a1fa24023af39e61cfce