If the system is configured to send logs to a remote ELK stack log server, (or other remote logging solution) as per requirement IBMW-LS-000230, this requirement is Not Applicable. Signing is optional. The encrypted and/or signed audit logs are found under the ${server.config.dir}/logs directory and are named audit.log for the most recent, and audit_.log for any archived logs. Two keystores are recommended but not required when doing both encryption and signing (ikeyman as part of the JDK may be used) and a certificate imported into each. One keystore will contain the certificate used to encrypt the logs; the other keystore will contain the certificate used to sign the logs. The audit configuration must define the location of every keystore, their passwords, and the alias of each certificate used to encrypt and sign the logs. 1. Enable the following features: appSecurity-2.0 audit-1.0 ssl-1.0 2. Verify a keystore is configured. The following is a JKS keystore example. PKCS12 is also a viable keystore: 3. Enable auditFileHandler encryption. Signing the logs is optional.

Name	Audit Name	Plugin	Category
IBMW-LS-000320 - The WebSphere Liberty Server must be configured to encrypt log information.	DISA IBM WebSphere Liberty Server STIG v2r2	Unix	AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY
IBMW-LS-000320 - The WebSphere Liberty Server must be configured to encrypt log information.	DISA IBM WebSphere Liberty Server STIG v2r4	Unix	AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY

Detections

Analytics

Item Search