UCF STIG Viewer Logo

The WebSphere Application Server must protect log information from unauthorized modification.


Overview

Finding ID Version Rule ID IA Controls Severity
V-81255 WBSP-AS-000750 SV-95969r1_rule Medium
Description
WebSphere uses role-based access controls to restrict access to log data. To take advantage of this capability, WebSphere administrators must identify specific users and place them into their respective roles. The auditor role is used for controlling access to logs.
STIG Date
IBM WebSphere Traditional V9.x Security Technical Implementation Guide 2018-08-24

Details

Check Text ( C-80951r2_chk )
Review System Security Plan and the system documentation.

Identify the home folder and user account for the WebSphere installation.

Log on to the operating system that is hosting the WebSphere application server. By default, WebSphere will be installed in the "/opt/IBM/Websphere" folder on UNIX like systems and in the "C:\Program Files\IBM\Websphere\" folder on Windows systems.

On UNIX systems, verify file permissions for the "WebSphere" folder are set to "770" for the WebSphere user, group and other. Permissions do not propagate to sub-folders.

On Windows systems, verify file permissions for "WebSphere" folder allow SYSTEM, WebSphere User, and Admin Group full control. Permissions do not propagate to sub-folders.

If file permissions exceed these restrictions, this is a finding.
Fix Text (F-88035r2_fix)
On the system hosting the WebSphere application server, log on to the operating system with admin rights.

Navigate to the "WebSphere" folder, change permissions on the folder. Do not propagate permissions to sub-folders.

For UNIX systems: set "WebSphere folder" permissions to "770".

For Windows systems: set "WebSphere folder" permission to allow full control for SYSTEM, WebSphere user, and Admin Group. Do not propagate permissions to sub-folders.