Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Looking for resources/guidance on hardening a JBoss installation on windows for production use.

share|improve this question
add comment

2 Answers

I am going to assume you are using Jboss in a standard N-tier configuration.

(1) Harden Windows http://iase.disa.mil/stigs/stig/windows_server_2008_security_guide.pdf http://iase.disa.mil/stigs/stig/win2k-XP-03-vista-addendumv6r1-052107.doc

(2) Harden Jboss http://iase.disa.mil/stigs/stig/application-services-stig-v1r1.pdf

Remember to address the embedded Tomcat via the Application services STIG

(3) Harden associated Webservers http://iase.disa.mil/stigs/stig/Web-Server-STIG-V6R1.pdf

(4) Harden associated Databases http://iase.disa.mil/stigs/stig/database-stig-v8r1.zip

(5) Consider Defense in Depth Add maybe a web application firewall http://www.owasp.org/index.php/Web_Application_Firewall

Below are some suggestions for your network

(6) Add a file integrity tool such as Samhain or Tripwire

(7) Ensure you have syslog enabled, going to a syslog server, with Splunk looking at everything.

(8) Use a network intrusion detection system, maybe something in an easy package to run like Security Onion. Connect it to your syslog and Splunk

share|improve this answer
add comment

You don't state the JBoss version nor what the server will be doing nor if it will be facing the web, so there's not much we can tell.

Basically you should start by removing all the services you don't need. You can find some guidance here. The idea is that you need to remove everything except what's really necessary.

If the server will be web facing, block all ports but the ones you need (80 probably). Also, probably not a good idea to run as admin!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.