STIG configuration profile

What it is

JANUS_STIG_PROFILE=true puts Janus into its documented STIG configuration. It sets the defaults below, refuses settings that would undo them with a named error before serving anything, and logs one “stig profile” line at startup with the profile in force. It works in both editions; run it on the FIPS edition for FIPS 140-3 validated cryptography.

The profile is designed to support your ATO against the DISA Application Security and Development STIG. It is a configuration, not a certification, and the authorization to operate belongs to your authorizing official for your system.

License

The STIG profile is a Business feature: Business, Enterprise and trial keys include it, Community does not. With the profile on, Janus refuses to start unless the installed key verifies and is a business or enterprise edition key (trial keys are). No key, a Community key, or a key that fails verification stops startup with one line ending “Start a free trial at https://janusedge.com/pricing”. An expired Business key, even past its grace period, keeps the gateway running.

The check reads the key’s edition, so older Business keys without the stig_profile feature name qualify. It reads JANUS_LICENSE_FILE or the key installed under Administration → Settings → License & updates, and needs no network access.

Defaults

Offline (JANUS_OFFLINE=true): no update check, no license sync, no personal subscriptions; nothing contacts janusedge.com. License sync is pinned off.

Audit retention 913 days (30 months) instead of 730.

Local-account authenticator codes use HMAC-SHA-256 for new enrollments; HMAC-SHA-1 enrollments are refused, and the person sets up two-factor again or uses a recovery code. LDAP skip_verify is refused when saved and ignored at connect time.

Administrative changes fail closed: every state-changing API and SCIM request runs in one database transaction with its audit record. If the audit record cannot be written, the change is rolled back and the request answers 500 audit.write_failed. Janus Chat messages, dry runs and tests, classifier benchmark starts and personal subscription connect/poll are not wrapped: they are not configuration changes, and their handlers use background work.

Certificate revocation checking is hard (JANUS_TLS_REVOCATION=hard): every outbound TLS server certificate, and each intermediate, is checked by stapled OCSP, then the OCSP responder, then the CRL. A revoked certificate, or one whose status cannot be established, fails the connection. JANUS_OCSP_RESPONDER points every OCSP query at an enclave responder. Certificates that publish no OCSP or CRL source are accepted and counted. Outside the profile revocation checking is off unless JANUS_TLS_REVOCATION is soft (revoked fails, unknown is allowed and logged) or hard.

Audit export (CSV) is available to every administrator, in every edition and license state.

Refused at startup

SQLite: set JANUS_DATABASE_URL=postgres://…. The FIPS edition refuses SQLite too, with or without the profile.

JANUS_DEV_AUTH=true, whatever JANUS_DEV_AUTH_ALLOW_UNSAFE says.

Plain HTTP. JANUS_PUBLIC_URL must start with https://, cookies must stay Secure, and TLS must be terminated by Janus (JANUS_TLS_CERT_PATH and JANUS_TLS_KEY_PATH, or JANUS_TLS_SELF_SIGNED=true) or by a proxy you declare in JANUS_TRUSTED_PROXIES. Janus cannot see whether the proxy-to-Janus hop is encrypted; if your enclave requires it, set JANUS_TLS_REQUIRE=true so Janus refuses to start without serving TLS itself. A self-signed listener certificate is reported as a deviation (APSC-DV-002300).

JANUS_AUDIT_RETENTION_DAYS below 913.

Anything that phones home: JANUS_LICENSE_SYNC=true, JANUS_UPDATE_CHECK=true or JANUS_OFFLINE=false.

A saved LDAP directory with skip_verify on, or an upstream with Allow untrusted certificate on. Add the CA under Administration → Settings → Certificates (or mount it with JANUS_CA_DIR) and turn the setting off.

JANUS_TLS_REVOCATION=off. Use soft while an OCSP responder or CRL is being made reachable from the enclave.

JANUS_STIG_PROFILE=true
JANUS_DATABASE_URL=postgres://janus@db.example.mil/janus
JANUS_PUBLIC_URL=https://janus.example.mil
JANUS_TRUSTED_PROXIES=10.42.0.0/16      # the TLS-terminating ingress
JANUS_LICENSE_FILE=/etc/janus/license/janus.lic

Security settings it enforces

Administration → Settings → Security holds sessions, the sign-in notice, lockout, passwords, audit forwarding and smart cards (see Security settings). With the profile on, every value is read with the STIG values as a floor, and saving a weaker value is refused with the control named.

Idle sign-out ≤ 15 minutes for people and ≤ 10 for administrators (APSC-DV-000070/000080); at most 3 sessions per person; the DoD Notice and Consent banner acknowledged before any sign-in (APSC-DV-000520/000530); lockout after 3 failures in 15 minutes until an administrator unlocks (APSC-DV-000500/000510); passwords of 15 or more characters with upper case, lower case, digit and special, 8 characters changed, 24-hour minimum and 180-day maximum age, and none of the last 5 (APSC-DV-001680..001780).

Sign-in, sign-out, failures, lockouts, time-outs and access-denied are always audited with the source address and outcome. Audit forwarding to syslog or a SIEM and smart-card (CAC/PIV) sign-in are on the same page; they need a destination and the DoD roots, so the profile does not switch them on by itself.