DISA STIGS Viewer

Finding ID	Version	Rule ID	IA Controls	Severity
V-224782	ISEC-06-550300	SV-224782r1013858_rule		Medium

Description

LockOutRealm prevents brute force attacks against user passwords. Removal of unneeded or nonsecure functions, ports, protocols, and services mitigate the risk of unauthorized connection of devices, unauthorized transfer of information, or other exploitation of these resources. The organization must perform a periodic scan/review of the application (as required by CCI-000384) and disable functions, ports, protocols, and services deemed to be unneeded or nonsecure.

STIG	Date
ISEC7 Sphere Security Technical Implementation Guide	2024-08-20

Check Text (C-26473r1013856_chk)

Log in to the ISEC7 SPHERE server. Navigate to <Drive>:\Program Files\Isec7 SPHERE\Tomcat\Config Open the server.xml file with Notepad. Select Edit >> Find and search for LockOutRealm. Confirm the following line is in the server.xml file: <Realm className="org.apache.catalina.realm.LockOutRealm"> If it is not found or has been commented out, this is a finding. If the LockOutRealm has been removed and cannot be used, this is a finding.

Fix Text (F-26461r1013857_fix)

Log in to the ISEC7 SPHERE server. Navigate to <Drive>:\Program Files\Isec7 SPHERE\Tomcat\Config Open the server.xml file with Notepad. Select Edit >> Find and search for LockOutRealm. Add the following line is in the server.xml file: <Realm className="org.apache.catalina.realm.LockOutRealm"> Restart the ISEC7 SPHERE Web service in the services.msc.