Procedure 2.1. Evaluated Configuration Setup Configuration

1. Disable Simple Network Management Protocol (SNMP)

   Delete the directory JBOSS_HOME/server/production/deploy/snmp-adaptor.sar

   $ rm -rf JBOSS_HOME/server/production/deploy/snmp-adaptor.sar

2. Disable Remote Method Invocation (RMI) under the Internet Inter-ORB Protocol (IIOP)

   To disable RMI/IIOP delete following files:
   • JBOSS_HOME/server/production/conf/jacorb.properties
   • JBOSS_HOME/server/production/deploy/iiop-service.xml
   • JBOSS_HOME/server/production/lib/jacorb.jar

   $ rm JBOSS_HOME/server/production/conf/jacorb.properties
   $ rm JBOSS_HOME/server/production/deploy/iiop-service.xml
   $ rm JBOSS_HOME/server/production/lib/jacorb.jar

3. Disable AJP from JBoss Web.

   Comment out the following section from JBOSS_HOME/server/production/deploy/jbossweb.sar/server.xml:

   <Connector protocol="AJP/1.3" port="8009" address="${jboss.bind.address}" redirectPort="8443" />

4. Disable Clustering High-Availability JNDI service (port 1102)

   To disable clustering HA, do the following:
   1. Delete the file JBOSS_HOME/server/production/deploy/cluster/hajndi-jboss-beans.xml

      rm JBOSS_HOME/server/production/deploy/cluster/hajndi-jboss-beans.xml

   2. Disable the HA Naming service interface via HTTP by commenting out following <mbean> definition in JBOSS_HOME/server/production/deploy/httpha-invoker.sar/META-INF/jboss-service.xml:

      <mbean code="org.jboss.invocation.http.server.HttpProxyFactory" name="jboss:service=invoker,type=http,target=HAJNDI">

5. Enable Password Hashing

   Use password hashing and do not store plain text passwords on the server.

   Note

   For more information regarding configuring password hashing, refer to the Password Hashing section in the JBoss Security Guide.

6. Disable Technology Preview Components

   Ensure Technology Preview components are disabled.

   Note

   Section 2.5.8, “Technology Preview Components” details the components shipped with JBoss Enterprise Application Platform that must be disabled, and how to disable them.

Procedure 2.2. Monitor Server Startup and Shutdown Events

1. Uncomment Security Audit Appender

   Uncomment the following block.

   <!-- Security AUDIT Appender --> 
   <appender name="AUDIT" class="org.jboss.logging.appender.DailyRollingFileAppender"> 
     <errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/>
     <param name="File" value="${jboss.server.log.dir}/audit.log"/> 
     <param name="Append" value="true"/> 
     <param name="DatePattern" value="'.'yyyy-MM-dd"/> 
     <layout class="org.apache.log4j.PatternLayout"> 
       <param name="ConversionPattern" value="%d %-5p [%c] (%t:%x) %m%n"/> 
     </layout> 
   </appender>

2. Uncomment Security Audit Provider

   Uncomment the following block:

   <!-- Category specifically for Security Audit Provider -->
   <category name="org.jboss.security.audit.providers.LogAuditProvider" additivity="false">
     <priority value="TRACE"/>
     <appender-ref ref="AUDIT"/>
   </category>

3. Configure SecurityInterceptor logging level

   Set the logging level of the SecurityInterceptor class to TRACE by adding the <priority> element to the root <category> element.

   <category name="org.jboss.ejb.plugins.SecurityInterceptor">
     <priority value="TRACE" />
     <appender-ref ref="AUDIT" />
   </category>

4. Enable logging for ServerImpl log messages

   Set the priority and appender-ref levels for the Microcontainer bootstrap by adding the <category> block as specified.

   <category name="org.jboss.bootstrap.microcontainer">
     <priority value="INFO"/>
     <appender-ref ref="AUDIT"/> 
   </category>

5. Enable logging for web-based requests

   If you need additional logging for web-based requests, uncomment the AccessLogValve in JBOSS_HOME/server/production/deploy/jbossweb.sar/server.xml.

   <Valve className="org.apache.catalina.valves.AccessLogValve"
     prefix="localhost_access_log." suffix=".log"
     pattern="common" directory="${jboss.server.home.dir}/log"
     resolveHosts="false" />
   

   The access log is saved in the log directory of the server configuration.

6. Update ConversionPattern

   Update the ConversionPattern parameter in the appender/layout element to show thread information by replacing the Default Pattern with the Full Pattern:

   <!--The full pattern: Date MS Priority [Category] (Thread:NDC) Message -->
   <param name="ConversionPattern" value="%d %-5r %-5p [%c] (%t:%x) %m%n"/>

Procedure 2.3. Configure Database

1. Create DefaultDS file

   Create a default DS file for the desired database. Examples of this file are located in JBOSS_HOME/docs/examples/jca.

   Important

   A DefaultDS file must be supplied in the JBOSS_HOME/server/production/deploy directory.

2. Delete HSQLDB files

   Delete the following files as they refer to the HSQLDB database:
   • JBOSS_HOME/server/production/deploy/hsqldb-ds.xml
   • JBOSS_HOME/common/lib/hsqldb.jar
   • JBOSS_HOME/common/lib/hsqldb-plugin.jar
   • JBOSS_HOME/server/production/deploy/messaging/hsqldb-persistence-service.xml

3. Remove HSQLDB Security Domain

   Comment out the security domain for HsqlDbRealm in the JBOSS_HOME/server/production/conf/login-config.xml file as shown.

   <!-- Security domains for testing new jca framework
   <application-policy name = "HsqlDbRealm">
     <authentication>
       <login-module 
         code = "org.jboss.resource.security.ConfiguredIdentityLoginModule" 
         flag = "required">
         <module-option name = "principal">sa</module-option>
         <module-option name = "userName">cctest</module-option>
         <module-option name = "password">cc1248</module-option>
         <module-option name = "managedConnectionFactoryName">
           jboss.jca:service=LocalTxCM,name=DefaultDS
         </module-option>
       </login-module>
     </authentication>
   </application-policy>
   -->
   

4. Copy persistence service configuration file

   The [database]-persistence-service.xml file contains the persistence service definition for JBoss Messaging, for the database specified by the [database] in the filename.
   Copy the [database]-persistence-service.xml file that corresponds to the database you are using from the JBOSS_HOME/docs/examples/jms directory to JBOSS_HOME/server/production/deploy.

   Note

   The table definitions in any [database]-persistence-service.xml are not optimized for performance.

5. Relocate JDBC driver libraries

   Place the supported JDBC driver libraries in the directory JBOSS_HOME/server/production/lib/.

   Important

   Ensure you follow the policy guidelines in Section 2.5.5, “Java Security Manager Policy File ” and choose a supported JDBC driver from Table 2.1, “Allowed 5.1.0 Database and JDBC Driver Versions” or Table 2.2, “Allowed 5.1.1 Database and JDBC Driver Versions”to maintain an evaluated configuration.

6. Add JDBC Grant Statement

   Add the following grant statement for the JDBC driver you are using to the Java Security Manager policy file. The policy file is located in JBOSS_HOME/bin/security_cc.policy. Substitute the directory name of the JDBC driver where [cc.jdbc.driver] is specified in the code sample.

   Important

   Each JDBC driver can use different permissions. Check the JDBC driver documentation and replace java.security.AllPermission; with a secure permission scheme supported by the driver.

   // granting permissions to JDBC driver 
   grant codeBase "file:${jboss.server.home.dir}/lib/[cc.jdbc.driver]" { 
     permission java.security.AllPermission; 
   };

7. Oracle Database Persistence Plugin Optimization

   When using the Oracle Database, the database persistence plugin definition must be changed in JBOSS_HOME/server/production/deploy/ejb2-timer-service.xml from being:

   <attribute name="DatabasePersistencePlugin">
   org.jboss.ejb.txtimer.GeneralPurposeDatabasePersistencePlugin
   </attribute>

   to being:

   <attribute name="DatabasePersistencePlugin">
   org.jboss.ejb.txtimer.OracleDatabasePersistencePlugin
   </attribute>

Procedure 3.2. Downloading Files

1. Open http://access.redhat.com in a web browser.
2. Click the Downloads option in the menu across the top of the page.
3. In the Downloads menu, click on JBoss Enterprise Middleware.
4. Enter your login information.
   Result:

   You are taken to the Software Downloads page.

5. Select Application Platform from either the drop-down box or the menu on the left.
   Result:

   You are presented with a list of file downloads.

6. Select either 5.1.0 or 5.1.1 from the Version drop-down box.
   Result:

   You are presented with all versions of the selected platform.

7. Select the correct software

   For 5.1.0, click the Application Platform 5.1.0 Binary link (not the download link).
   For 5.1.1, click the Application Platform 5.1.1 Binary link (not the download link).
   Result:

   You are presented with the Software Details screen, with SHA-256 information.

8. On the displayed Software Details page, click the Download located next to the File drop-down box.

   Note

   Record the SHA-256 sum from the Software Details screen. You use this checksum to verify the authenticity of the download in Section 3.3.2, “Verifying the Downloaded Files”
9. Continue to Procedure 3.3, “Installation using ZIP file”

Procedure 3.3. Installation using ZIP file

1. Unzip filejboss-eap-[version].zip to extract the archive contents into the location of your choice.
   Result:

   This creates the jboss-eap-[version] directory, with an un-configured installation of JBoss Enterprise Application Platform.

2. Optional: Download and Install Native Components

   Native components are downloaded separate to the primary application binary.
   1. Choose a Native Components binary that corresponds to one of the evaluated Operating Systems listed in Section 2.1.2, “Operating System”.
   2. Click the name of the Native Component binary to display the SHA-256 checksum.
   3. Repeat the process in Section 3.3.2, “Verifying the Downloaded Files” to verify the file's authenticity.
   4. Unzip the downloaded file to JBoss installation directory (such as jboss-eap-5.1.0) as run.sh can locate the components automatically when starting the Enterprise Application Server.
   5. Run the following rm command to remove the https directory and retain the compatibility with Common Criteria:

      # rm -rf JBOSS_INSTALL_DIR/jboss-ep-[version]/native/JBOSS_NATIVE_LIB/httpd

      Substitute JBOSS_INSTALL_DIR with JBoss installation directory, [version] with the product version you chose, and JBOSS_NATIVE_LIB with the library directory (lib or lib64).

      Note

      Only Red Hat Enterprise Linux 4, Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6 JBoss Native Components are certified and supported in Common Criteria certified configurations.

3. Install Security Patches

   Follow the procedures in Section 3.3.4, “Download Patches” to correctly download the required security patches for the evaluated configuration and follow the patch installation instructions inside individual ZIP files (README.txt).

Procedure 3.4. Install required security patches

1. Open http://access.redhat.com in a web browser.
2. Hover over the Downloads option in the menu across the top of the page.
3. In the Downloads menu, click JBoss Enterprise Middleware
4. Enter your login information.
   Result:

   You are taken to the Software Downloads page.

5. Select Application Platform in the drop-down box or in the menu on the left.
   Result:

   You are presented with a list of file downloads.

6. Select 5.1.0 or 5.1.1 from the Version drop-down box, depending on the platform version you want to install.
7. For 5.1.1, download the JBoss Remoting 2.5.3SP1 security advisory:
   1. Click the Security Advisories tab label.
      Result:

      You are presented with the list of available security advisories.

   2. Click the Apply jboss remoting 2.5.3SP1 fix link.
   3. On the displayed Software Details tab, click the Download link next to the File drop-down box and confirm the download of the JBPAPP-5386.zip file.

      Note

      Record the SHA-256 checksum from the Software Details screen. You use this checksum to verify the authenticity of the download in Section 3.3.2, “Verifying the Downloaded Files”
8. Download security_cc.policy to EAP 5.1:
   1. Click the Patches tab label.
      Result:

      You are presented with the list of available security advisories.

   2. Click the Add security_cc.policy to EAP 5.1x link.
   3. On the displayed Software Details tab, click the Download link next to the File drop-down box and confirm the download of the JBPAPP-5367.zip file.

      Note

      Record the SHA-256 sum from the Software Details screen. You use this checksum to verify the authenticity of the download in Section 3.3.2, “Verifying the Downloaded Files”

Procedure 3.5. Download the JBoss Enterprise Application Platform ISO

1. Open http://access.redhat.com in a web browser.
2. Log in using your customer portal credentials.
3. Hover the mouse over the Download menu in the top menu bar.
4. Under the Red Hat Enterprise Linux group, click Downloads.
   Result:

   The Download Software page opens, which lists all ISO images available for Red Hat products.

5. In the list of available software, expand the node for the Red Hat Enterprise Linux system supported by the certification.

   Note

   If you are not sure which node to select, refer to Section 2.1.2, “Operating System” for the supported Red Hat operating systems, and Table 3.1, “5.1.0 SHA-256 checksum values” and Table 3.2, “5.1.1 SHA-256 checksum values” for the list of supported ISO images.
6. Click the JBoss Application Platform (v 5) group.
   Result:

   You are redirected to the ISO image download page.

7. Verify the ISO is correct for your system by visually comparing the SHA-256 checksum with the checksum declared in Table 3.1, “5.1.0 SHA-256 checksum values” or Table 3.2, “5.1.1 SHA-256 checksum values”

   Note

   The name of the ISO link is not the same as the actual ISO filename. Use the tables specified to verify you are selecting the correct ISO image.
8. Record the corresponding SHA-256 sum for the ISO download. You use this checksum to verify the authenticity of the ISO in the next procedure.
9. Click the ISO link.
   Result:

   The download will begin. When the download has finished, you have successfully downloaded the correct ISO for the evaluated configuration.

Procedure 3.6. Install ISO on Red Hat Enterprise Linux 4

1. Mount ISO Image

   Mount the ISO image downloaded in Procedure 3.5, “Download the JBoss Enterprise Application Platform ISO” to /mnt/jboss.

   [root ~]# mkdir /mnt/jboss
   [root ~]# mount -o loop PATH_TO_ISO_IMAGE /mnt/jboss

2. Create Local up2date Repository

   Create a local repository for the ISO to retrieve packages from during installation.
   Add the following line to /etc/sysconfig/rhn/sources.

   echo "dir jbosslocal /mnt/jboss/RedHat/RPMS/" >> /etc/sysconfig/rhn/sources

3. Install JBoss Enterprise Application Platform

   Run the following up2date command, replacing WS_CHOICE with jbossas-ws-native or jbossas-ws-cxf

   [root ~]# up2date -i jbossas-messaging WS_CHOICE jbossas jbossas-security-policy-cc

4. Optionally install Native Components

   Run the following up2date command to install certified and supported native components

   [root ~]# up2date jboss-eap5-native

Procedure 3.7. Install ISO on Red Hat Enterprise Linux 5

1. Mount ISO Image

   Mount the ISO image downloaded in Procedure 3.5, “Download the JBoss Enterprise Application Platform ISO” to /mnt/jboss.

   [root ~]# mkdir /mnt/jboss
   [root ~]# mount -o loop PATH_TO_ISO_IMAGE /mnt/jboss

2. Create Repository

   Create a local repository for the ISO to retrieve packages from during installation.
   Create a file named jbosslocal.repo in /etc/yum.repos.d/.

   [root ~]# cat << EOF > /etc/yum.repos.d/jbosslocal.repo 
   [jbosslocal] 
   name=jbosslocal 
   baseurl=file:///mnt/jboss/JBEAP 
   enabled=1 
   gpgcheck=0 
   EOF

3. Install JBoss Enterprise Application Platform

   Run the following yum command, replacing WS_CHOICE with jbossas-ws-native or jbossas-ws-cxf:

   [root ~]# yum install jbossas-messaging WS_CHOICE jbossas jbossas-security-policy-cc

4. Optionally install Native Components

   Run the following yum install command to install certified and supported native components:

   [root ~]# yum install jboss-eap5-native

Procedure 3.8. Install ISO on Red Hat Enterprise Linux 6

1. Mount ISO Image

   Mount the ISO image downloaded in Procedure 3.5, “Download the JBoss Enterprise Application Platform ISO” to /mnt/jboss.

   [root ~]# mkdir /mnt/jboss
   [root ~]# mount -o loop PATH_TO_ISO_IMAGE /mnt/jboss

2. Create Repository

   Create a local repository for the ISO to retrieve packages from during installation.
   Create a file named jbosslocal.repo in /etc/yum.repos.d/.

   [root ~]# cat << EOF > /etc/yum.repos.d/jbosslocal.repo 
   [jbosslocal] 
   name=jbosslocal 
   baseurl=file:///mnt/jboss 
   enabled=1 
   gpgcheck=0 
   EOF

3. Install JBoss Enterprise Application Platform

   Run the following yum command, replacing WS_CHOICE with jbossas-ws-native or jbossas-ws-cxf

   [root ~]# yum install jbossas-messaging WS_CHOICE jbossas jbossas-security-policy-cc

4. Optionally install Native Components

   Run the following yum install command to install certified and supported native components

   [root ~]# yum install jboss-eap5-native