Detections
Analytics

1.2 IBMW-LS-000020

Information

The WebSphere Liberty Server Quality of Protection (QoP) must be set to use TLSv1.2 or higher.

GROUP ID: V-250323RULE ID: SV-250323r960759

Quality of Protection in WebSphere Liberty specifies the security level, ciphers, and mutual authentication settings for the Secure Socket Layer (SSL/TLS) configuration. For Quality of Protection settings to apply, the security feature (appSecurity-2.0) must be defined in order to configure a user registry for the servlet to authenticate against. The SSL feature (ssl-1.0) must be defined in order to configure ssl settings, and the ldap feature (ldapRegistry-3.0) must be defined in order to configure an enterprise-level user registry for authentication of users.

Solution

To ensure the QoP is set to TLS v1.2 or higher, the ${server.config.dir}/server.xml file must be configured as follows:

<featureManager>appSecurity-2.0ssl-1.0</featureManager>

For every SSL configuration, the sslProtocol field must be set to TLS v1.2 or higher.

See Also

https://workbench.cisecurity.org/benchmarks/23823

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-17(2), CCI|CCI-000068, Rule-ID|SV-250323r960759_rule, STIG-ID|IBMW-LS-000020, Vuln-ID|V-250323

Plugin: Unix

Control ID: 57d60f49dafb9e1e3b805288990d24717df2b47ce961928f2838cace6b67fa3f