The MQ Appliance WebGUI interface to the messaging server must prohibit the use of cached authenticators after one hour.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-74749	MQMH-AS-000190	SV-89423r1_rule		Medium

Description
When the messaging server is using PKI authentication, a local revocation cache must be stored for instances when the revocation cannot be authenticated through the network, but if cached authentication information is out of date, the validity of the authentication information may be questionable.

STIG	Date
IBM MQ Appliance V9.0 AS Security Technical Implementation Guide	2017-06-09

Details

Check Text ( C-74605r1_chk )

Display the SSL Server Profile associated with the WebGUI using the (CLI). Log on as an admin to the MQ appliance using SSH terminal access. Enter: co show web-mgmt To note the name of the ssl-server, enter: crypto ssl-server show Verify the following are displayed: caching on cache-timeout 3600 If the ssl-server configuration does not exist, or if caching is "off", or if the cache-timeout setting does not equal “3600” seconds (60 minutes), this is a finding.

Fix Text (F-81365r1_fix)
Display the SSL Server Profile associated with the WebGUI (CLI). Enter: co show web-mgmt [Note the name of the ssl-server] Define the cache parameters of the SSL Server using the CLI. Enter: co crypto ssl-server caching on cache-timeout <3600> exit exit write mem y