WBSP-AS-001020 - The WebSphere Application Server local file-based user registry must not be used.

Information

WebSphere does not provide direct audit of changes to the built-in file registry. The built-in file registry must not be used to support user logon accounts. Use an LDAP/AD server and manage user accounts centrally.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Navigate to Security >> Global Security.

Under 'User Account Repository', select 'Stand alone LDAP' from the 'Available realm definitions' drop-down.

Click on 'Configure'.

Select an existing user from the LDAP directory to be the primary WebSphere admin user.

Identify the type of LDAP server; specify an IP or DNS name for the LDAP Server, and the port used to connect to the LDAP server.

Specify BASE DN.

Specify the BIND DN.

Specify the BIND Password.

Select the 'SSL enabled' check box to use secure LDAP.

Click 'Apply'.

Click 'Save'.

Go to Global Security.

Select 'Standalone LDAP registry' from the 'Available realm definitions' drop-down.

Click 'Set as current'.

Click 'Apply'.

Click 'Save'.

Restart the dmgr and synchronize the JVMs.

See Also

http://iasecontent.disa.mil/stigs/zip/U_IBM_WebSphere_Traditional_V9-x_V1R1_STIG.zip

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2, CAT|II, CCI|CCI-000764, Rule-ID|SV-96019r1_rule, STIG-ID|WBSP-AS-001020, Vuln-ID|V-81305

Plugin: Windows

Control ID: e141c34228fbad71b6ddcc9ca31fb2a4c32b43234dffdcddca153243a66968ad