OpenControls Logo

STIG Viewer

STIGViewer Support

Multifactor authentication for network access to privileged accounts must be used.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-250335IBMW-LS-000390SV-250335r1015469_ruleCCI-000187high
Description
Multifactor authentication creates a layered defense and makes it more difficult for an unauthorized person to access the application server. If one factor is compromised or broken, the attacker still has at least one more barrier to breach before successfully breaking into the target. Unlike a simple username/password scenario where the attacker could gain access by knowing both the username and password without the user knowing his account was compromised, multifactor authentication adds the requirement that the attacker must have something from the user, such as a token, or to biometrically be the user. When accessing the application server via a network connection, administrative access to the application server must be PKI Hardware Token enabled. The high level steps required for configuring Liberty Server to use certificate based authentication include the following: 1. Configure Web Application with client certificate authentication. 2. Configure Liberty SSL configuration with client authentication. 3. Configure Liberty LDAP Security Configuration with certificate filter. Satisfies: SRG-APP-000149-AS-000102, SRG-APP-000151-AS-000103, SRG-APP-000402-AS-000247, SRG-APP-000403-AS-000248, SRG-APP-000177-AS-000126
STIGDate
IBM WebSphere Liberty Server Security Technical Implementation Guide2025-02-11

Related Frameworks

4 mappings across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (9) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-03.1Acceptance of PIV Credentials from Other Organizations
1.00
IAC-10.2PKI-Based Authentication
1.00
IAC-06Multi-Factor Authentication (MFA)
0.50
IAC-06.1Network Access to Privileged Accounts
0.50
IAC-06.2Network Access to Non-Privileged Accounts
0.50
IAC-06.3Local Access to Privileged Accounts
0.50
IAC-06.4Out-of-Band Multi-Factor Authentication
0.50
IAC-10.7Hardware Token-Based Authentication
0.50
TDA-02.2Information Assurance Enabled Products
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (76) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-11Device Lock
1.00
AC-11(1)Pattern-hiding Displays
1.00
AC-12Session Termination
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00

+66 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.5.3
1.00
CCI4 mappings
CCI-000187
1.00
CCI-000765
1.00
CCI-002009
1.00
CCI-002010
1.00

Details

Check Text (C-250335r1015469_chk)

As a user with local file access to ${server.config.dir}/server.xml file, verify the TLS connection used for managing the server is configured to use clientAuthentication. <featureManager> <feature>appSecurity-2.0</feature> <feature>ldapRegistry-3.0</feature> <feature>transportSecurity-1.0</feature> </featureManager> Verify the TLS connection used for managing the server is configured to use clientAuthentication. The following is used as an example. If the clientAuthentication setting for the TLS management application is not set to "true", this is a finding. EXAMPLE: <!-- default SSL configuration is defaultSSLSettings --> <sslDefault sslRef="defaultSSLSettings" /> <ssl id="defaultSSLSettings" keyStoreRef="defaultKeyStore" sslProtocol="SSL_TLSv2" trustStoreRef="defaultTrustStore" clientAuthentication="true"/> Access the web management interface via a web browser and verify TLS secured connectivity to the web based management application.

Fix Text (F-53724r862982_fix)

Refer to IBM documentation on how to configure TLS and client based certificate authentication for additional configuration details. The following is a summary list of items needed to configure the system for certificate based authentication. Production systems and installations will vary. The application’s web.xml file must be configured to use client certs. EXAMPLE: <login-config> <auth-method>CLIENT-CERT</auth-method> </login-config> The server.xml features must be configured to use transportSecurity and an ldap configuration. <featureManager> <feature>appSecurity-2.0</feature> <feature>ldapRegistry-3.0</feature> <feature>transportSecurity-1.0</feature> </featureManager> The server.xml TLS and LDAP settings must be configured. The following is an EXAMPLE only. "Default" verbiage and keystore information in the below SSL configuration will be different in production systems. <!-- default SSL configuration is defaultSSLSettings --> <sslDefault sslRef="defaultSSLSettings" /> <ssl id="defaultSSLSettings" keyStoreRef="defaultKeyStore" sslProtocol="SSL_TLSv2" trustStoreRef="defaultTrustStore" clientAuthentication="true"/> <keyStore id="defaultKeyStore" location="key.jks" type="JKS" password="defaultPWD" /> <keyStore id="defaultTrustStore" location="key.jks" type="JKS" password="defaultPWD" /> Configure LDAP certificate filter settings according the certificates being used. <ldapRegistry id="ldap" realm="SampleLdapRealm" host="${ldap.server.name}" port="${ldap.server.port}" ignoreCase="true" baseDN="${ldap.server.base.dn}" ldapType="${ldap.vendor.type}" certificateMapMode="Certificate_Filter" or "Exact_DN" certificateFilter="${your certificate mapping}" searchTimeout="8m" sslEnabled="true"> </ldapRegistry>