IBM Security Scanner for WebSphere Application Server is a command-line Java tool that checks for some of the potential security vulnerabilities caused by improper or incorrect WebSphere Application Server security configuration. The tool produces an HTML report that contains the security configuration checks performed, the status of each check, a corrective action if necessary and a link to the information center task related to the corrective action. The tool runs on WebSphere Application Server Versions 5.x, 6.0.x and 6.1.x.
The IBM WebSphere Developer Technical Journal article WebSphere Application Server V5 Advanced Security and System Hardening identifies many of the checks that are performed and why they are important. Although the article refers to WebSphere Application Server Version 5, the information applies to version 6.x as well.
It
scans static WebSphere Application Server (Base and Network Deployment only)
security configuration files to look for potential vulnerabilities
It attempts to identify security configuration changes
that could strengthen the security of the WebSphere Application Server
The
tool does not check for runtime penetration
vulnerabilities.
The tool is not a general purpose WebSphere Application Server configuration
diagnostic tool intended to aid in the problem determination of configuration
problems.
The tool is not a fail safe guarantee that system is totally secure.
The tool does not do network, host, physical, or operating system security
vulnerability analysis.
Important
Note: This tool can only point out WebSphere Application Server
configuration items which, if corrective action is taken, may improve the
overall security of the WebSphere Application server. IBM makes no claim or
guarantee that the tool detects all possible security configuration issues or
that if corrective action is taken for the items it does detect, that the
WebSphere Application Server system will be completely secure from any or all
possible threats. Network security, operating system security, physical
security, in addition to WebSphere Application Security, should all be
considered.
The following table enumerates the WebSphere Application Server Security Configurations checked for by the tool
|
Core
Security Configuration Items Checked |
Description of the Check |
|
Administrative
Security |
Checks if Administrative Security is enabled on the WebSphere Application Server installation |
|
Application Security |
Checks if Application Security is enabled on the WebSphere Application Server installation |
|
Certificates |
The
expiration date of certificates used by WebSphere Application Server is
displayed. The tool also checks if the certificate is a default certificate
that is shipped as part of the product. |
|
CORBA
Namespace |
Checks whether CORBA Namespace is protected |
|
SSL
between WebSphere Application Server and LDAP |
Checks if SSL is enabled between WebSphere Application Server and LDAP sever |
|
Authentication
Mechanism |
Checks to see the authentication mechanism being used |
|
Encryption
for Distributed Replication Service (DRS) |
Checks if encryption is enabled for DRS
|
|
Sample
Applications |
Checks if sample applications are installed |
|
Administrative
User Ids |
Checks to see if multiple administrative userids are defined |
|
Extended
Security Configuration Items Checked |
Description
of the Check
|
|
Administrative
Roles |
Checks to see if multiple administrative roles are defined |
|
WebContainer
HTTPS |
Checks if the WebContainer has HTTPS transports defined |
|
Java2
security |
Checks to see if Java2 security is enabled and if it is enabled, it checks if overly generous Java2 permissions are set |
The tool runs on the following versions of WebSphere Application Server
The tool runs on the following operating systems
The following are limitations of the tool
The tool reads various WebSphere Application Server configuration files and related WebSphere Application Server installed artifacts in order to perform the security checks. This tool also depends upon and uses many of the libraries of the installed WebSphere Application Server. The tool is packaged as a zip file, wsst.zip. This zip file contains the following files:
Complete the following steps to install the tool on OS/400, Windows, UNIX and zOS
Note:
Complete the following steps to launch the tool on OS/400, Windows, UNIX and zOS
The output report has the name of the WebSphere Application Server installation scanned along with the build details of the installation at the top of the report. Also mentioned at the top of the report are the version of the tool that generated the report and the date and time the report was generated.
The report has 3 sections. The first section reports on the security checks performed. The status of each check is either “OK” or “Improvements Possible”. If the status is "OK", then the configuration item does not need improvement or a corrective action. If the status is “Improvements Possible” look for the “Area of Concern” to understand what was detected by the check and why it could be a potential problem. Look at the “Corrective Action” column to see how to address the issue. The “InfoCenter Task Reference” column points to the exact link in InfoCenter that can be followed in order to perform the “Corrective Action”.
The second section of the report is “Extended Checks”. These are some of the security configurations found which may or may not be a security concern depending on your setup. The intention of the “Extended Checks” is to make you aware of the status of these security configurations.
The third section of the report is present if any errors are detected when performing a check. It reports on the errors encountered when performing a check. If a check cannot be completed due to errors, it does not appear under the first two sections, but appears in the third section along with the error encountered.
If the tool is run on a WebSphere Application Server Version 6.x.x or WebSphere Application Server Network Deployment version 6.x.x installation that has multiple profiles, the tool performs all the security checks against each profile. The output report will have 3 sections for each profile (the error section will only appear if errors were encountered).
At the end of the report, helpful links are provided. To understand the security configurations and why that they are needed, see the link to the IBM WebSphere Developer Technical Journal article on WebSphere Application Security Hardening appears that you should refer to in order to understand the security configurations and why they are needed. A link is also provided to the IBM support website that has the latest updates and fixes available.
The following tables shows all the possible values for each security check
Core
Security Configuration Items Table
|
Security Configuration Item Name |
Value of Status |
Possible values for Area of Concern |
Value of Corrective Action |
|
Administrative Security (High Priority) |
OK |
Administrative Security is enabled. Only users with specific rights can use the WebSphere Application Server administrative tools to perform any administrative operation |
No action required |
|
|
Improvements Possible |
Administrative Security is disabled. This means that all network links are insecure and that any user with access to the deployment manager (HTTP to the Web admin console, or SOAP/IIOP to the JMX management ports) can use the WebSphere Application Server administrative tools to perform any administrative operation, up to and including removing existing servers. |
Enable Administrative Security |
|
Application
Security (High Priority) |
OK |
Application Security is enabled. Application security
enables security for the applications in your environment. This type of
security provides application isolation and requirements for authenticating
application users |
No action required |
|
|
|
Application Security is disabled. Application security
enables security for the applications in your environment. This type of
security provides application isolation and requirements for authenticating
application users |
Enable Application Security |
|
Certificate Checker (High Priority) |
Improvements Possible |
Certificate within keystore: NodeDefaultKeyStore, alias: default will expire on Thu
Apr 19 |
No need to create new certificate. Create a new password for keystore NodeDefaultKeyStore |
|
|
Improvements Possible |
Certificate within keystore: NodeDefaultKeyStore, alias: dummyclientsigner
is a default certificate from IBM and should not be used. The certificate
will expire on Wed Oct 13 |
Create a new certificate. Create a new password for keystore NodeDefaultKeyStore |
|
|
Improvements Possible |
Certificate within keystore: NodeDefaultTrustStore, alias: test will expire on Tue Nov
28 |
Create a new certificate. Create a new password for keystore NodeDefaultKeyStore |
|
|
OK |
Certificate within keystore: DefaultKeyStore, alias: TEST2 will expire on Thu Apr 19 |
OK |
|
CORBA Namespace Security (High Priority) |
OK |
CORBA Naming roles are configured |
No action required |
|
|
Improvements Possible |
The CORBA Namespace can be modified by All Authenticated users. Any authenticated user can alter the JNDI namespace. The default naming security policy is to grant all users read access to the CosNaming space and to grant any authenticated user the privilege to modify the contents of the CosNaming space. You can restrict user access to the CosNaming space. |
Configure CORBA Naming Roles |
|
|
Improvements Possible |
The CORBA Namespace can be modified by Everyone. Anyone can alter the JNDI namespace. The default naming security policy is to grant all users read access to the CosNaming space and to grant any authenticated user the privilege to modify the contents of the CosNaming space. You can restrict user access to the CosNaming space. |
Configure CORBA Naming Roles |
|
|
Improvements Possible |
Administrative Security is not enabled, therefore security policies are not enforced. As a result, anyone can modify CORBA Namespace. |
Enable Administrative Security and configure CORBA Naming Roles |
|
SSL usage between LDAP and WebSphere Application Server (Medium Priority) |
Improvements Possible |
Administrative Security is not enabled, cannot check if LDAP user registry is being used |
Configure a user registry as part of Enabling Administrative Security |
|
|
OK |
User Registry is LDAP. SSL between
WebSphere Application Server and LDAP is enabled |
No action required |
|
|
Improvements Possible |
User Registry is LDAP. SSL
between WebSphere Application Server and LDAP is disabled |
Enable SSL between WebSphere Application Server and LDAP User Registry |
|
|
OK |
User registry being used is not LDAP |
No action required |
|
Authentication Mechanism (Medium Priority) |
Improvements Possible |
Administrative Security is not enabled, therefore no authentication mechanism is being used |
Choose an authentication mechanism as part of Enabling Administrative Security. |
|
|
Improvements Possible |
LTPA Authentication is not enabled. SWAM Authentication is being used. SWAM is weaker than LTPA since it relies on the HTTP Session for maintaining state. SWAM authentication is not forwardable to remote EJBs and cannot be used in distributed environments such WebSphere Application Server Network Deployment. SWAM is intended for simple, non-distributed, single application server run-time environments. |
Use LTPA Authentication mechanism in distributed environments and for Single Sign On (SSO) |
|
|
OK |
LTPA Authentication mechanism is enabled. Lightweight Third Party Authentication (LTPA) is intended for distributed, multiple application server and machine environments. It supports single signon (SSO). |
No action required |
|
Encryption for Distributed Replication Service (Medium Priority) |
OK |
Data Replication Service(DRS) is not being used to exchange data among application servers |
No action required |
|
|
OK |
Encryption is enabled on Distributed Replication Service(DRS). This ensures that the data shared among application servers is encrypted. |
No action required |
|
|
Improvements Possible |
Encryption is disabled on Distributed Replication Service(DRS). The data shared among application servers is not encrypted. |
Enable Encryption on DRS |
|
Sample Applications (Medium Priority) |
Improvements Possible |
WebSphere Sample Applications
are installed. |
Uninstall Sample Application(s): Application names |
|
|
OK |
WebSphere Sample Applications
are not installed |
No action required |
|
Administrative User IDs (Medium Priority) |
Improvements Possible |
Administrative Security is not enabled, therefore no administrative ids are configured. |
Create a serverID as part of Enabling Administrative Security. Then configure additional administrative user ids to protect this server ID and enable more effective audit logging |
|
|
OK |
Multiple Administrative user IDs are configured. When WebSphere security is enabled, a single security ID is initially configured as the Security Server ID. Configuring multiple administrative user ids can protect this server ID and enable more effective audit logging |
No action required |
|
|
Improvements Possible |
Multiple Administrative user IDs are not configured. When WebSphere security is enabled, a single security ID is initially configured as the Security Server ID. Configuring multiple administrative user ids can protect this server ID and enable more effective audit logging |
Configure Additional Administrative User IDs |
Extended
Security Configuration Items Table
|
Security Configuration Item Name |
Possible values for Findings |
Value of Possible Action |
|
Administrative Roles |
Administrative Security is not enabled, so no administrative roles are being used. WebSphere Application Server allows four administrative roles: Administrator, Operator, Monitor, Configurator. These roles make it possible to give individuals (and automated systems) access appropriate to their level of need. |
Create an administrative role as part of Enabling Administrative Security, then create additional roles. |
|
|
Multiple Administrative Roles are configured. WebSphere Application Server allows four administrative roles: Administrator, Operator, Monitor, Configurator. These roles make it possible to give individuals (and automated systems) access appropriate to their level of need. |
No action required |
|
|
Multiple Administrative Roles are not configured. WebSphere Application Server allows four administrative roles: Administrator, Operator, Monitor, Configurator. These roles make it possible to give individuals (and automated systems) access appropriate to their level of need. |
Configure Additional Administrative Roles |
|
WebContainer HTTPS Checker (Medium Priority) |
Only HTTP transport is defined between the webserver and the application server. Communication between the webserver and application server is over HTTP which is unencrypted and in clear text |
Evaluate if HTTP transport is required for your environment. If sensitive information is being transmitted between the web server and the application server, it is recommended to use HTTPS (SSL) transports between the web server and application server |
|
|
HTTPS transports are defined between the webserver and the application server. If you choose HTTPS transport, communication between the webserver and application server is over HTTPS which is encrypted and secure |
No action required |
|
|
No transports are defined between the webserver and the application server |
Set up HTTPS (SSL) transports between the webserver and application server, in order to have the communication between webserver and application server be encrypted |
|
Java2 Security |
Administrative Security is not enabled, therefore Java2 Security is not being used. Java 2 security provides a policy-based, fine-grain access control mechanism that increases overall system integrity by checking for permissions of installed applications before allowing them access to certain protected system resources such as file I/O, sockets, and properties. |
Enable Administrative Security, create an appropriate
Java2 Security policy for each of the installed applications and enable Java2
Security |
|
|
Java2 Security is enabled. |
No action required |
|
|
Java2 Security is disabled. Java 2 security provides a policy-based, fine-grain access control mechanism that increases overall system integrity by checking for permissions of installed applications before allowing them access to certain protected system resources such as file I/O, sockets, and properties. |
Create an appropriate Java2 Security Policy file for each
of the installed applications and enable Java2 Security |
|
|
In application "appName", the permission "All Permissions" is granted to codeBase, "codeBase" This disables the access control mechanism provided by Java 2 Security for this application. |
The permission "All Permissions" is granted to
WebSphere Application Server system applications such as adminconsole.ear
and filetransfer.ear. |
The following terms are trademarks of International Business Machines
Corporation in the
Java and all Java-based trademarks are trademarks of Sun Microsystems, Inc.
in the
Microsoft, Windows, Windows NT, and the Windows logo are trademarks of
Microsoft Corporation in the
UNIX is a registered trademark of The Open Group in the
Linux is a trademark of Linus Torvalds
in the
Other company, product, or service names may be trademarks or service marks of
others.