Ensure 'trustDefaultCerts' is set to 'false'

ThấpCấp 2Tự độngwebsphere

Mô tả

The default certificates from the Java runtime are trusted by the server in addition to the certificates configured in the SSL/TLS configurations in the server. Audit: reads server.xml, configDropins/defaults/*.xml, configDropins/overrides/*.xml and files pulled in with <include> for every Liberty server found under WLP_USER_DIR, /opt/ibm/wlp/usr, /opt/IBM/WebSphere/Liberty/usr, /opt/ol/wlp/usr, /usr/local/wlp/usr or /config; it ignores XML comments and fails if no server.xml is readable. trustDefaultCerts must be false on every <ssl> element (shipped templates set true). The attribute must be set explicitly because the Liberty default is not compliant.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

bad=0; n=0; nl='
'
r=""
for b in "${WLP_USER_DIR:-}" /opt/ibm/wlp/usr /opt/IBM/WebSphere/Liberty/usr /opt/ol/wlp/usr /usr/local/wlp/usr; do
  [ -n "$b" ] && [ -d "$b/servers" ] || continue
  for s in "$b"/servers/*/; do [ -f "${s}server.xml" ] && r="$r$s$nl"; done
done
[ -f /config/server.xml ] && r="$r/config/$nl"
strip(){ awk 'BEGIN{RS="<!--"} NR==1{printf "%s",$0; next} {i=index($0,"-->"); if(i) printf "%s",substr($0,i+3)}'; }
gather(){ s=$1; { cat "${s}server.xml" "${s}"configDropins/defaults/*.xml "${s}"configDropins/overrides/*.xml; } 2>/dev/null | strip
  for loc in $(cat "${s}server.xml" "${s}"configDropins/defaults/*.xml "${s}"configDropins/overrides/*.xml 2>/dev/null | strip | tr '\r\n\t' '   ' | grep -oE '<include[[:space:]][^>]*>' | sed -n 's/.*location[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p'); do
    case $loc in http*) continue;; esac; loc=$(printf '%s' "$loc" | sed "s#\${server.config.dir}/*##"); case $loc in /*) f=$loc;; *) f=$s$loc;; esac
    [ -f "$f" ] && strip < "$f"; done; }
tag(){ printf '%s\n' "$X" | grep -oE "<$1([[:space:]][^>]*)?>"; }
chk(){ t=$(tag "$1"); if [ -z "$t" ]; then [ "$5" = na ] && return 0; [ "$4" = y ] && return 0; return 1; fi
  tot=$(printf '%s\n' "$t" | grep -c ''); v=$(printf '%s\n' "$t" | sed -n "s/.*[[:space:]]$2[[:space:]]*=[[:space:]]*[\"']\([^\"']*\)[\"'].*/\1/p"); st=0
  [ -n "$v" ] && st=$(printf '%s\n' "$v" | grep -c ''); case " config httpSession webAppSecurity jwtSso webContainer httpDispatcher applicationMonitor sslDefault httpOptions ltpa mpMetrics samesite transportLayer authenticationLayer attributeLayer " in *" $1 "*) [ "$st" -gt 0 ] && tot=$st;; esac; ok=$3; neg=n; case $ok in '!'*) neg=y; ok=${ok#!};; esac
  if [ "$st" -gt 0 ]; then m=$(printf '%s\n' "$v" | grep -ciE "^($ok)\$"); if [ "$neg" = n ]; then [ "$m" -eq "$st" ] || return 1; else [ "$m" -eq 0 ] || return 1; fi; fi
  [ "$st" -lt "$tot" ] && [ "$4" != y ] && return 1; return 0; }
IFS="$nl"; for s in $r; do n=$((n+1)); X=$(gather "$s" | tr '\r\n\t' '   ' | tr -s ' ')
chk ssl trustDefaultCerts false n d || bad=1
done; unset IFS; [ "$n" -gt 0 ] || exit 1; [ "$bad" -eq 0 ] && echo compliant || echo noncompliant

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Add the trustDefaultCerts attribute to all ssl elements to ${server.config.dir}/configDropins/overrides/*.xml and set the value to false. <ssl trustDefaultCerts="false" />

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: webspheretls
Tham chiếu: CIS IBM WebSphere Liberty Benchmark v1.0.0 - 4.2.1 Ensure 'trustDefaultCerts' is set to 'false'

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target websphere --level 2