TMA-WEBSPHERE-4.2.7
Ensure Hostname verification for TLS communication is enabled
Beschreibung
Hostname verification is a server identity check that is used to ensure that a client is talking to the correct server. The check is performed on the client side of an SSL communication and involves looking at the server’s certificate Subject Alternative Name (or the SubjectDN) to see if it matches the host part of the URL that was used to make the outbound request. Audit: reads server.xml, configDropins/defaults/*.xml, configDropins/overrides/*.xml and files pulled in with <include> for every Liberty server found under WLP_USER_DIR, /opt/ibm/wlp/usr, /opt/IBM/WebSphere/Liberty/usr, /opt/ol/wlp/usr, /usr/local/wlp/usr or /config; it ignores XML comments and fails if no server.xml is readable. Every <ssl> must set verifyHostname="true" and any <webTarget> must not set disableCNCheck="true".
So wird geprüft
Prüfmethode: Shell-Befehl
bad=0; n=0; nl='
'
r=""
for b in "${WLP_USER_DIR:-}" /opt/ibm/wlp/usr /opt/IBM/WebSphere/Liberty/usr /opt/ol/wlp/usr /usr/local/wlp/usr; do
[ -n "$b" ] && [ -d "$b/servers" ] || continue
for s in "$b"/servers/*/; do [ -f "${s}server.xml" ] && r="$r$s$nl"; done
done
[ -f /config/server.xml ] && r="$r/config/$nl"
strip(){ awk 'BEGIN{RS="<!--"} NR==1{printf "%s",$0; next} {i=index($0,"-->"); if(i) printf "%s",substr($0,i+3)}'; }
gather(){ s=$1; { cat "${s}server.xml" "${s}"configDropins/defaults/*.xml "${s}"configDropins/overrides/*.xml; } 2>/dev/null | strip
for loc in $(cat "${s}server.xml" "${s}"configDropins/defaults/*.xml "${s}"configDropins/overrides/*.xml 2>/dev/null | strip | tr '\r\n\t' ' ' | grep -oE '<include[[:space:]][^>]*>' | sed -n 's/.*location[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p'); do
case $loc in http*) continue;; esac; loc=$(printf '%s' "$loc" | sed "s#\${server.config.dir}/*##"); case $loc in /*) f=$loc;; *) f=$s$loc;; esac
[ -f "$f" ] && strip < "$f"; done; }
tag(){ printf '%s\n' "$X" | grep -oE "<$1([[:space:]][^>]*)?>"; }
chk(){ t=$(tag "$1"); if [ -z "$t" ]; then [ "$5" = na ] && return 0; [ "$4" = y ] && return 0; return 1; fi
tot=$(printf '%s\n' "$t" | grep -c ''); v=$(printf '%s\n' "$t" | sed -n "s/.*[[:space:]]$2[[:space:]]*=[[:space:]]*[\"']\([^\"']*\)[\"'].*/\1/p"); st=0
[ -n "$v" ] && st=$(printf '%s\n' "$v" | grep -c ''); case " config httpSession webAppSecurity jwtSso webContainer httpDispatcher applicationMonitor sslDefault httpOptions ltpa mpMetrics samesite transportLayer authenticationLayer attributeLayer " in *" $1 "*) [ "$st" -gt 0 ] && tot=$st;; esac; ok=$3; neg=n; case $ok in '!'*) neg=y; ok=${ok#!};; esac
if [ "$st" -gt 0 ]; then m=$(printf '%s\n' "$v" | grep -ciE "^($ok)\$"); if [ "$neg" = n ]; then [ "$m" -eq "$st" ] || return 1; else [ "$m" -eq 0 ] || return 1; fi; fi
[ "$st" -lt "$tot" ] && [ "$4" != y ] && return 1; return 0; }
IFS="$nl"; for s in $r; do n=$((n+1)); X=$(gather "$s" | tr '\r\n\t' ' ' | tr -s ' ')
chk ssl verifyHostname true n d || bad=1
chk webTarget disableCNCheck false y na || bad=1
done; unset IFS; [ "$n" -gt 0 ] || exit 1; [ "$bad" -eq 0 ] && echo compliant || echo noncompliant- Erwartete Ausgabe
compliant
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
Enable hostname verification in the SSL configuration by adding the verifyHostname attribute to the ssl configuration element in ${server.config.dir}/configDropins/overrides/<any file name>.xml <ssl ... verifyHostname="true" /> For JAX-RS client, enable hostname verification in the webTarget element by adding the disableCNCheck attribute in ${server.config.dir}/configDropins/overrides/<any file name>.xml <webTarget ... disableCNCheck="false" />
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- webspheretls
- Referenz
- CIS IBM WebSphere Liberty Benchmark v1.0.0 - 4.2.7 Ensure Hostname verification for TLS communication is enabled
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
tmaegis scan --target websphere