Detections
Analytics

1.5 IBMW-LS-000050

Information

Users in the REST API admin role must be authorized.

GROUP ID: V-250326RULE ID: SV-250326r960792

Users with console access and OS permissions to the folders where the Liberty Server is installed can make changes to the server. In addition, REST API calls that execute server management tasks are available and can be executed remotely. Adding a user to the admin role will allow that user to make changes to the server via the REST API calls.

The admin role must be controlled and users who are in that role must be authorized.

Solution

If an admin user exists in either a basic user registry or a quickstartsecurity registry, edit the ${server.config.dir}/server.xml file and remove the basic registry and/or quickstartsecurity registry settings.

If an admin user exists via an LDAP user registry setting, document and approve the user(s) or group that have been assigned to the admin role and ensure anyone granted REST API admin rights is authorized.

LDAP EXAMPLE:cn=bob,o=ibm,c=us

BASIC REGISTRY EXAMPLE:<basicRegistry><group name="group1" ...></basicRegistry>

QUICKSTARTSECURITY EXAMPLE:<featureManager>restConnector-2.0</featureManager><quickStartSecurity userName="bob" userPassword="bobpassword" /><keyStore id="defaultKeyStore" password="keystorePassword"/>

See Also

https://workbench.cisecurity.org/benchmarks/23823

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3, CCI|CCI-000213, Rule-ID|SV-250326r960792_rule, STIG-ID|IBMW-LS-000050, Vuln-ID|V-250326

Plugin: Unix

Control ID: ddef65c38e9363afef5be4206347a94389e5747d45bc35892c890addbe127de0