TMAegis
Aturan lainnya untuk websphere

TMA-WEBSPHERE-10.3

Ensure 'enableWelcomePage' is set to 'false'

SedangLevel 1Otomatiswebsphere

Deskripsi

The WebSphere Liberty welcome page is enabled by default and is displayed when the root context “/” is accessed. Audit: reads server.xml, configDropins/defaults/*.xml, configDropins/overrides/*.xml and files pulled in with <include> for every Liberty server found under WLP_USER_DIR, /opt/ibm/wlp/usr, /opt/IBM/WebSphere/Liberty/usr, /opt/ol/wlp/usr, /usr/local/wlp/usr or /config; it ignores XML comments and fails if no server.xml is readable. enableWelcomePage on <httpDispatcher> must be false (default true). The attribute must be set explicitly because the Liberty default is not compliant.

Cara pemeriksaan

Metode audit: Perintah shell

shell
bad=0; n=0; nl='
'
r=""
for b in "${WLP_USER_DIR:-}" /opt/ibm/wlp/usr /opt/IBM/WebSphere/Liberty/usr /opt/ol/wlp/usr /usr/local/wlp/usr; do
  [ -n "$b" ] && [ -d "$b/servers" ] || continue
  for s in "$b"/servers/*/; do [ -f "${s}server.xml" ] && r="$r$s$nl"; done
done
[ -f /config/server.xml ] && r="$r/config/$nl"
strip(){ awk 'BEGIN{RS="<!--"} NR==1{printf "%s",$0; next} {i=index($0,"-->"); if(i) printf "%s",substr($0,i+3)}'; }
gather(){ s=$1; { cat "${s}server.xml" "${s}"configDropins/defaults/*.xml "${s}"configDropins/overrides/*.xml; } 2>/dev/null | strip
  for loc in $(cat "${s}server.xml" "${s}"configDropins/defaults/*.xml "${s}"configDropins/overrides/*.xml 2>/dev/null | strip | tr '\r\n\t' '   ' | grep -oE '<include[[:space:]][^>]*>' | sed -n 's/.*location[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p'); do
    case $loc in http*) continue;; esac; loc=$(printf '%s' "$loc" | sed "s#\${server.config.dir}/*##"); case $loc in /*) f=$loc;; *) f=$s$loc;; esac
    [ -f "$f" ] && strip < "$f"; done; }
tag(){ printf '%s\n' "$X" | grep -oE "<$1([[:space:]][^>]*)?>"; }
chk(){ t=$(tag "$1"); if [ -z "$t" ]; then [ "$5" = na ] && return 0; [ "$4" = y ] && return 0; return 1; fi
  tot=$(printf '%s\n' "$t" | grep -c ''); v=$(printf '%s\n' "$t" | sed -n "s/.*[[:space:]]$2[[:space:]]*=[[:space:]]*[\"']\([^\"']*\)[\"'].*/\1/p"); st=0
  [ -n "$v" ] && st=$(printf '%s\n' "$v" | grep -c ''); case " config httpSession webAppSecurity jwtSso webContainer httpDispatcher applicationMonitor sslDefault httpOptions ltpa mpMetrics samesite transportLayer authenticationLayer attributeLayer " in *" $1 "*) [ "$st" -gt 0 ] && tot=$st;; esac; ok=$3; neg=n; case $ok in '!'*) neg=y; ok=${ok#!};; esac
  if [ "$st" -gt 0 ]; then m=$(printf '%s\n' "$v" | grep -ciE "^($ok)\$"); if [ "$neg" = n ]; then [ "$m" -eq "$st" ] || return 1; else [ "$m" -eq 0 ] || return 1; fi; fi
  [ "$st" -lt "$tot" ] && [ "$4" != y ] && return 1; return 0; }
IFS="$nl"; for s in $r; do n=$((n+1)); X=$(gather "$s" | tr '\r\n\t' '   ' | tr -s ' ')
chk httpDispatcher enableWelcomePage false n d || bad=1
done; unset IFS; [ "$n" -gt 0 ] || exit 1; [ "$bad" -eq 0 ] && echo compliant || echo noncompliant
Output yang diharapkan
compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Perform the following to prevent Websphere Liberty from serving a welcome page from context root folder. Add the enableWelcomePage attribute to the httpDispatcher element to ${server.config.dir}/configDropins/overrides/*.xml and set it to false. <httpDispatcher enableWelcomePage="false" />

Properti

Sistem operasi
Apa saja
Tag
websphereinformation-disclosure
Referensi
CIS IBM WebSphere Liberty Benchmark v1.0.0 - 10.3 Ensure 'enableWelcomePage' is set to 'false'

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell
tmaegis scan --target websphere