1.20 - Remove default roles from production servers - 'admin-console default role != JBossAdmin|HttpInvoker|friend|guest'

Information

Remove, rename, or comment out the default role definitions in the default <application-policy> elements

Solution

Ensure the default role assignments have been removed, renamed, or commented out from the default properties files located in JBOSS_HOME/server/@[email protected]/conf/props/

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5e., CAT|II

Plugin: Unix

Control ID: 86a5f462de5dd8f0edcb591bd880f49536dc99dc58ab2064db13686bc739d804