The Apache Tomcat Manager Web app password must be cryptographically hashed with a DoD approved algorithm.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-97275	ISEC-06-550150	SV-106381r1_rule		Medium

Description
The Apache Tomcat Manager Web app password is stored in plain text in CATALINA_HOME/conf/tomcat-users.xml and should be encrypted so it is not visible to an intruder. Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read and easily compromised. Use of passwords for authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication. Examples of situations where a user ID and password might be used include: - When the user does not use a CAC and is not a current DoD employee, member of the military, or DoD contractor. - When a user has been officially designated as temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) (i.e., Temporary Exception User) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied. - When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection. If the password is already encrypted and not a plaintext password, this meets this requirement. Implementation of this requirement requires configuration of FIPS-approved cipher block algorithm and block cipher modes for encryption. This method uses a one-way hashing encryption algorithm with a salt value to validate a user's password without having to store the actual password. Performance and time required to access are factors that must be considered, and the one-way hash is the most feasible means of securing the password and providing an acceptable measure of password security. Verifying the user knows a password is performed using a password verifier. In its simplest form, a password verifier is a computational function that is capable of creating a hash of a password and determining if the value provided by the user matches the hash. A more secure version of verifying a user knowing a password is to store the result of an iterating hash function and a large random salt value as follows: H0 = H(pwd, H(salt)) Hn = H(Hn-1,H(salt)) In the above, "n" is a cryptographically-strong random [*3] number. "Hn" is stored along with the salt. When the application wishes to verify that the user knows a password, it simply repeats the process and compares "Hn" with the stored "Hn". A salt is essentially a fixed-length cryptographically strong random value. Another method is using a keyed-hash message authentication code (HMAC). HMAC calculates a message authentication code via a cryptographic hash function used in conjunction with an encryption key. The key must be protected as with any private key. This requirement applies to all accounts including authentication server, AAA, and local account, including the root account and the account of last resort.

Description

The Apache Tomcat Manager Web app password is stored in plain text in CATALINA_HOME/conf/tomcat-users.xml and should be encrypted so it is not visible to an intruder. Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read and easily compromised. Use of passwords for authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication. Examples of situations where a user ID and password might be used include: - When the user does not use a CAC and is not a current DoD employee, member of the military, or DoD contractor. - When a user has been officially designated as temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) (i.e., Temporary Exception User) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied. - When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection. If the password is already encrypted and not a plaintext password, this meets this requirement. Implementation of this requirement requires configuration of FIPS-approved cipher block algorithm and block cipher modes for encryption. This method uses a one-way hashing encryption algorithm with a salt value to validate a user's password without having to store the actual password. Performance and time required to access are factors that must be considered, and the one-way hash is the most feasible means of securing the password and providing an acceptable measure of password security. Verifying the user knows a password is performed using a password verifier. In its simplest form, a password verifier is a computational function that is capable of creating a hash of a password and determining if the value provided by the user matches the hash. A more secure version of verifying a user knowing a password is to store the result of an iterating hash function and a large random salt value as follows: H0 = H(pwd, H(salt)) Hn = H(Hn-1,H(salt)) In the above, "n" is a cryptographically-strong random [*3] number. "Hn" is stored along with the salt. When the application wishes to verify that the user knows a password, it simply repeats the process and compares "Hn" with the stored "Hn". A salt is essentially a fixed-length cryptographically strong random value. Another method is using a keyed-hash message authentication code (HMAC). HMAC calculates a message authentication code via a cryptographic hash function used in conjunction with an encryption key. The key must be protected as with any private key. This requirement applies to all accounts including authentication server, AAA, and local account, including the root account and the account of last resort.

STIG	Date
ISEC7 EMM Suite v6.x Security Technical Implementation Guide	2019-09-05

Details

Check Text ( C-96113r1_chk )
Verify the Apache Tomcat Manager Web app password is hashed using SHA-256 (or SHA-512). Login to the ISEC7 EMM Suite server. Navigate to :\Program Files\ISEC7 EMM Suite\Tomcat\conf\ Open tomcat-users.xml and verify the user password has been hashed with an obfuscated password. ex: Open :\Program Files\ISEC7 EMM Suite\Tomcat\conf\server.xml with Notepad.exe Select Edit >> Find and search for CredentialHandler. Confirm the text: Close the file. If the Apache Tomcat Manager Web app password is not hashed using SHA-256 (or SHA-512), this is a finding.

Check Text ( C-96113r1_chk )

Verify the Apache Tomcat Manager Web app password is hashed using SHA-256 (or SHA-512).

Login to the ISEC7 EMM Suite server.
Navigate to :\Program Files\ISEC7 EMM Suite\Tomcat\conf\
Open tomcat-users.xml and verify the user password has been hashed with an obfuscated password.

ex:

Open :\Program Files\ISEC7 EMM Suite\Tomcat\conf\server.xml with Notepad.exe

Select Edit >> Find and search for CredentialHandler.

Confirm the text:

Close the file.

If the Apache Tomcat Manager Web app password is not hashed using SHA-256 (or SHA-512), this is a finding.

Fix Text (F-102957r1_fix)
To encrypt the Tomcat Manager Web app password, run the ISEC7 integrated installer or use the following manual procedure. Note: The ISEC7 integrated installer will configure SHA-512 as the hash algorithm, which is not available with the manual procedure. The manual procedure will configure SHA-256. Both are DoD approved. Login to the ISEC7 EMM Suite server. Browse to :\Program Files\ISEC7 EMM Suite\Tomcat\conf and open Tomcat-Users.xml Open the Command Prompt and CD to :\Program Files\ISEC7 EMM Suite\Tomcat\bin Execute the following command: digest -a SHA-256 -h org.apache.catalina.realm.MessageDigestCredentialHandler * *where password is the 15 character password designated for the account Copy the output, which is the SHA-256 hashed digest password. In Tomcat-Users.xml, add in the password for the user with the obfuscated output. ex: Save the file. Open :\Program Files\ISEC7 EMM Suite\Tomcat\conf\server.xml with Notepad.exe Select Edit >> Find and search for CredentialHandler. Replace the text with: Save the file. Restart the ISEC7 EMM Suite Web service using the services.msc

Fix Text (F-102957r1_fix)

To encrypt the Tomcat Manager Web app password, run the ISEC7 integrated installer or use the following manual procedure.

Note: The ISEC7 integrated installer will configure SHA-512 as the hash algorithm, which is not available with the manual procedure. The manual procedure will configure SHA-256. Both are DoD approved.

Login to the ISEC7 EMM Suite server.
Browse to :\Program Files\ISEC7 EMM Suite\Tomcat\conf and open Tomcat-Users.xml
Open the Command Prompt and CD to :\Program Files\ISEC7 EMM Suite\Tomcat\bin
Execute the following command:

digest -a SHA-256 -h org.apache.catalina.realm.MessageDigestCredentialHandler *

*where password is the 15 character password designated for the account

Copy the output, which is the SHA-256 hashed digest password.
In Tomcat-Users.xml, add in the password for the user with the obfuscated output.

ex:

Save the file.

Open :\Program Files\ISEC7 EMM Suite\Tomcat\conf\server.xml with Notepad.exe
Select Edit >> Find and search for CredentialHandler.
Replace the text with:
Save the file.
Restart the ISEC7 EMM Suite Web service using the services.msc