UCF STIG Viewer Logo

OHS must use FIPS modules to encrypt passwords during transmission.


Overview

Finding ID Version Rule ID IA Controls Severity
V-64409 OH12-1X-000241 SV-78899r1_rule High
Description
Data used to authenticate, especially passwords, needs to be protected at all times, and encryption is the standard method for protecting authentication data during transmission. Data used to authenticate can be passed to and from the web server for many reasons. Examples include data passed from a user to the web server through an HTTPS connection for authentication, the web server authenticating to a backend database for data retrieval and posting, and the web server authenticating to a clustered web server manager for an update.
STIG Date
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide 2019-01-04

Details

Check Text ( C-65161r1_chk )
1. As required, open $DOMAIN_HOME/config/fmwconfig/components/OHS//ssl.conf with an editor.

2. Search for the "SSLFIPS" directive at the OHS server configuration scope.

3. If the directive is omitted or is not set to "On", this is a finding.
Fix Text (F-70339r1_fix)
1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS//ssl.conf with an editor.

2. Search for the "SSLFIPS" directive at the OHS server configuration scope.

3. Set the "SSLFIPS" directive to "On", add the directive if it does not exist.