Ensure Hostname verification for TLS communication is enabled

HighLevel 1Automatedwebsphere

Description

Hostname verification is a server identity check that is used to ensure that a client is talking to the correct server. The check is performed on the client side of an SSL communication and involves looking at the server’s certificate Subject Alternative Name (or the SubjectDN) to see if it matches the host part of the URL that was used to make the outbound request. Audit: reads server.xml, configDropins/defaults/*.xml, configDropins/overrides/*.xml and files pulled in with <include> for every Liberty server found under WLP_USER_DIR, /opt/ibm/wlp/usr, /opt/IBM/WebSphere/Liberty/usr, /opt/ol/wlp/usr, /usr/local/wlp/usr or /config; it ignores XML comments and fails if no server.xml is readable. Every <ssl> must set verifyHostname="true" and any <webTarget> must not set disableCNCheck="true".

How it is checked

Audit method: Shell command

shell

bad=0; n=0; nl='
'
r=""
for b in "${WLP_USER_DIR:-}" /opt/ibm/wlp/usr /opt/IBM/WebSphere/Liberty/usr /opt/ol/wlp/usr /usr/local/wlp/usr; do
  [ -n "$b" ] && [ -d "$b/servers" ] || continue
  for s in "$b"/servers/*/; do [ -f "${s}server.xml" ] && r="$r$s$nl"; done
done
[ -f /config/server.xml ] && r="$r/config/$nl"
strip(){ awk 'BEGIN{RS="<!--"} NR==1{printf "%s",$0; next} {i=index($0,"-->"); if(i) printf "%s",substr($0,i+3)}'; }
gather(){ s=$1; { cat "${s}server.xml" "${s}"configDropins/defaults/*.xml "${s}"configDropins/overrides/*.xml; } 2>/dev/null | strip
  for loc in $(cat "${s}server.xml" "${s}"configDropins/defaults/*.xml "${s}"configDropins/overrides/*.xml 2>/dev/null | strip | tr '\r\n\t' '   ' | grep -oE '<include[[:space:]][^>]*>' | sed -n 's/.*location[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p'); do
    case $loc in http*) continue;; esac; loc=$(printf '%s' "$loc" | sed "s#\${server.config.dir}/*##"); case $loc in /*) f=$loc;; *) f=$s$loc;; esac
    [ -f "$f" ] && strip < "$f"; done; }
tag(){ printf '%s\n' "$X" | grep -oE "<$1([[:space:]][^>]*)?>"; }
chk(){ t=$(tag "$1"); if [ -z "$t" ]; then [ "$5" = na ] && return 0; [ "$4" = y ] && return 0; return 1; fi
  tot=$(printf '%s\n' "$t" | grep -c ''); v=$(printf '%s\n' "$t" | sed -n "s/.*[[:space:]]$2[[:space:]]*=[[:space:]]*[\"']\([^\"']*\)[\"'].*/\1/p"); st=0
  [ -n "$v" ] && st=$(printf '%s\n' "$v" | grep -c ''); case " config httpSession webAppSecurity jwtSso webContainer httpDispatcher applicationMonitor sslDefault httpOptions ltpa mpMetrics samesite transportLayer authenticationLayer attributeLayer " in *" $1 "*) [ "$st" -gt 0 ] && tot=$st;; esac; ok=$3; neg=n; case $ok in '!'*) neg=y; ok=${ok#!};; esac
  if [ "$st" -gt 0 ]; then m=$(printf '%s\n' "$v" | grep -ciE "^($ok)\$"); if [ "$neg" = n ]; then [ "$m" -eq "$st" ] || return 1; else [ "$m" -eq 0 ] || return 1; fi; fi
  [ "$st" -lt "$tot" ] && [ "$4" != y ] && return 1; return 0; }
IFS="$nl"; for s in $r; do n=$((n+1)); X=$(gather "$s" | tr '\r\n\t' '   ' | tr -s ' ')
chk ssl verifyHostname true n d || bad=1
chk webTarget disableCNCheck false y na || bad=1
done; unset IFS; [ "$n" -gt 0 ] || exit 1; [ "$bad" -eq 0 ] && echo compliant || echo noncompliant

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Enable hostname verification in the SSL configuration by adding the verifyHostname attribute to the ssl configuration element in ${server.config.dir}/configDropins/overrides/<any file name>.xml <ssl ... verifyHostname="true" /> For JAX-RS client, enable hostname verification in the webTarget element by adding the disableCNCheck attribute in ${server.config.dir}/configDropins/overrides/<any file name>.xml <webTarget ... disableCNCheck="false" />

Properties

Operating systems: Any
Tags: webspheretls
Reference: CIS IBM WebSphere Liberty Benchmark v1.0.0 - 4.2.7 Ensure Hostname verification for TLS communication is enabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target websphere