documentation_complete: true


title: 'The web server password(s) must be entrusted to the SA or Web Manager'

description: |-
    Normally, a service account is established for the web server. This is
    because a privileged account is not desirable and the server is designed to
    run for long uninterrupted periods of time. The SA or Web Manager will need
    password access to the web server to restart the service in the event or an
    emergency as the web server is not to restart automatically after an
    unscheduled interruption.

rationale: |-
    If the password is not entrusted to an SA or web manager the ability to
    ensure the availability of the web server is compromised.

severity: medium


ocil_clause: 'the web server password(s) are not entrusted to the SA or Web Manager'

ocil: |-
    The reviewed should make a note of the name of the account being used for
    the web service. This information may be needed later in the SRR. There
    may also be other server services running related to the web server in
    support of a particular web application, these passwords must be entrusted
    to the SA or Web Manager as well.

    Query the SA or Web Manager to determine if they have the web service
    password(s).

    NOTE: For installations that run as a service, or without a password,
    the SA or Web Manager having an Admin account on the system would meet
    the intent of this check.
