Details

The deployment scanner scans the file system where your AS instance is running to automatically deploy any new application copied in your deploy directory. If it is not needed, the deployment scanner must be disabled in order to prevent unauthorized files being deployed.

Solution

Configure the scan-interval parameter as -1 , this will configure the deployment scanner to only allow deployments from console or at instance startup.

Supportive Information

The following resource is also helpful.

• https://docs.jboss.org/author/display/AS72/Hardening+Guidelines

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Unix.

References

• 800-53|CM-7b.

Source

• Tenable.com/audits