Ensure Hostname verification for TLS communication is enabled

YüksekDüzey 1Otomatikwebsphere

Açıklama

Hostname verification is a server identity check that is used to ensure that a client is talking to the correct server. The check is performed on the client side of an SSL communication and involves looking at the server’s certificate Subject Alternative Name (or the SubjectDN) to see if it matches the host part of the URL that was used to make the outbound request. Audit: reads server.xml, configDropins/defaults/*.xml, configDropins/overrides/*.xml and files pulled in with <include> for every Liberty server found under WLP_USER_DIR, /opt/ibm/wlp/usr, /opt/IBM/WebSphere/Liberty/usr, /opt/ol/wlp/usr, /usr/local/wlp/usr or /config; it ignores XML comments and fails if no server.xml is readable. Every <ssl> must set verifyHostname="true" and any <webTarget> must not set disableCNCheck="true".

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

bad=0; n=0; nl='
'
r=""
for b in "${WLP_USER_DIR:-}" /opt/ibm/wlp/usr /opt/IBM/WebSphere/Liberty/usr /opt/ol/wlp/usr /usr/local/wlp/usr; do
  [ -n "$b" ] && [ -d "$b/servers" ] || continue
  for s in "$b"/servers/*/; do [ -f "${s}server.xml" ] && r="$r$s$nl"; done
done
[ -f /config/server.xml ] && r="$r/config/$nl"
strip(){ awk 'BEGIN{RS="<!--"} NR==1{printf "%s",$0; next} {i=index($0,"-->"); if(i) printf "%s",substr($0,i+3)}'; }
gather(){ s=$1; { cat "${s}server.xml" "${s}"configDropins/defaults/*.xml "${s}"configDropins/overrides/*.xml; } 2>/dev/null | strip
  for loc in $(cat "${s}server.xml" "${s}"configDropins/defaults/*.xml "${s}"configDropins/overrides/*.xml 2>/dev/null | strip | tr '\r\n\t' '   ' | grep -oE '<include[[:space:]][^>]*>' | sed -n 's/.*location[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p'); do
    case $loc in http*) continue;; esac; loc=$(printf '%s' "$loc" | sed "s#\${server.config.dir}/*##"); case $loc in /*) f=$loc;; *) f=$s$loc;; esac
    [ -f "$f" ] && strip < "$f"; done; }
tag(){ printf '%s\n' "$X" | grep -oE "<$1([[:space:]][^>]*)?>"; }
chk(){ t=$(tag "$1"); if [ -z "$t" ]; then [ "$5" = na ] && return 0; [ "$4" = y ] && return 0; return 1; fi
  tot=$(printf '%s\n' "$t" | grep -c ''); v=$(printf '%s\n' "$t" | sed -n "s/.*[[:space:]]$2[[:space:]]*=[[:space:]]*[\"']\([^\"']*\)[\"'].*/\1/p"); st=0
  [ -n "$v" ] && st=$(printf '%s\n' "$v" | grep -c ''); case " config httpSession webAppSecurity jwtSso webContainer httpDispatcher applicationMonitor sslDefault httpOptions ltpa mpMetrics samesite transportLayer authenticationLayer attributeLayer " in *" $1 "*) [ "$st" -gt 0 ] && tot=$st;; esac; ok=$3; neg=n; case $ok in '!'*) neg=y; ok=${ok#!};; esac
  if [ "$st" -gt 0 ]; then m=$(printf '%s\n' "$v" | grep -ciE "^($ok)\$"); if [ "$neg" = n ]; then [ "$m" -eq "$st" ] || return 1; else [ "$m" -eq 0 ] || return 1; fi; fi
  [ "$st" -lt "$tot" ] && [ "$4" != y ] && return 1; return 0; }
IFS="$nl"; for s in $r; do n=$((n+1)); X=$(gather "$s" | tr '\r\n\t' '   ' | tr -s ' ')
chk ssl verifyHostname true n d || bad=1
chk webTarget disableCNCheck false y na || bad=1
done; unset IFS; [ "$n" -gt 0 ] || exit 1; [ "$bad" -eq 0 ] && echo compliant || echo noncompliant

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Enable hostname verification in the SSL configuration by adding the verifyHostname attribute to the ssl configuration element in ${server.config.dir}/configDropins/overrides/<any file name>.xml <ssl ... verifyHostname="true" /> For JAX-RS client, enable hostname verification in the webTarget element by adding the disableCNCheck attribute in ${server.config.dir}/configDropins/overrides/<any file name>.xml <webTarget ... disableCNCheck="false" />

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: webspheretls
Referans: CIS IBM WebSphere Liberty Benchmark v1.0.0 - 4.2.7 Ensure Hostname verification for TLS communication is enabled

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target websphere