DOD STIG for JIRA & Confluence (this is a repeat of the one posted in bitbucket)

Question

Not sure how my initial question was put under bitbucket since it is a JIRA question.

Hello community,

I am working on getting my Data Center JIRA/Confluence setup authorized and they are wanting the DOD STIGs done, to include the Tomcat/apache server. Does anyone have or can point me to the documentation that states what you can and can't change. I have a dev version but it isn't as robust as operational.

Does Atlassian suggest not doing the extra configuration of the STIGs?

Thank you very much for any help you can give me

Tricia

Nic Brough -Adaptavist- · Answer

That makes a lot of sense now, thank you for explaining!

Yes, the short answer is "if you block stuff in Apache-Tomcat, or in Apache, or in Tomcat, then you could break Jira and Confluence"

It is not necessarily a bad thing - I deliberately break some of my Confluence spaces by blocking it in Apache unless the user is within a certain IP range.  Either I am using a computer at home, or I have used a VPN into my home network.  If I try to access those pages without, my Apache tells me to naff off.  It's easier than using firewalls!

But.  The TLDR answer: your Atlassian services need access to all pages the applications serve up, as well as the REST API for them.

Patricia Bascom · Answer

Sorry,

DoD is the Department of Defense and STIG is security settings, to basically lock down the server and application more than a base install.

basically I need to know if making Tomcat/Apache security changes past what is set during the base install will break JIRA and Confluence.  I unfortunately can't test making security changes in a Dev network as I can't replicate the operational configuration exactly.

Tricia

Nic Brough -Adaptavist- · Answer

Most people do not know what DOD or STIG means, I'd suggest explaining the TLA and FLA in use here.