Oracle WebLogic must provide the ability to write specified audit record content to an audit log server.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-235950	WBLC-02-000081	SV-235950r628628_rule		Medium

Description
Information system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application specific events, success/fail indications, filenames involved, access control or flow control rules invoked. Centralized management of audit records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. Application servers and their related components are required to be capable of writing logs to centralized audit log servers.

Description

Information system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application specific events, success/fail indications, filenames involved, access control or flow control rules invoked. Centralized management of audit records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. Application servers and their related components are required to be capable of writing logs to centralized audit log servers.

STIG	Date
Oracle WebLogic Server 12c Security Technical Implementation Guide	2021-03-18

Details

Check Text ( C-39169r628626_chk )
1. Access EM 2. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'JDBC Data Sources' 3. From the list of data sources, select the one named 'opss-audit-DBDS', which connects to the IAU_APPEND schema of the audit database. Note the value in the 'JNDI name' field 4. To verify, select 'Configuration' tab -> 'Connection Pool' tab 5. Ensure the 'URL' and 'Properties' fields contain the correct connection values for the IAU_APPEND schema 6. To test, select 'Monitoring' tab, select a server from the list and click 'Test Data Source'. Ensure test was successful. Repeat for each server in the list 7. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'Security' -> 'Security Provider Configuration' 8. Beneath 'Audit Service' section, click 'Configure' button 9. Ensure 'Data Source JNDI Name' value matches the JNDI Name value from data source in step 3 above 10. Repeat steps 2-6 for data source named 'wls-wldf-storeDS' and WLS schema If the location for audit data is not an audit log server, this is a finding.

Check Text ( C-39169r628626_chk )

1. Access EM
2. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'JDBC Data Sources'
3. From the list of data sources, select the one named 'opss-audit-DBDS', which connects to the IAU_APPEND schema of the audit database. Note the value in the 'JNDI name' field
4. To verify, select 'Configuration' tab -> 'Connection Pool' tab
5. Ensure the 'URL' and 'Properties' fields contain the correct connection values for the IAU_APPEND schema
6. To test, select 'Monitoring' tab, select a server from the list and click 'Test Data Source'. Ensure test was successful. Repeat for each server in the list
7. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'Security' -> 'Security Provider Configuration'
8. Beneath 'Audit Service' section, click 'Configure' button
9. Ensure 'Data Source JNDI Name' value matches the JNDI Name value from data source in step 3 above
10. Repeat steps 2-6 for data source named 'wls-wldf-storeDS' and WLS schema

If the location for audit data is not an audit log server, this is a finding.

Fix Text (F-39132r628627_fix)
1. Access AC 2. From 'Domain Structure', select 'Services' -> 'Data Sources' 3. Utilize 'Change Center' to create a new change session 4. Click 'New' data source to create a new data source for the audit data store using schema IAU_APPEND 5. Enter database details and JNDI name, click through wizard 6. Select all servers and clusters available as targets to deploy this data source to 7. Finish creating the data source and record the JNDI name 8. Access EM 9. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'Security' -> 'Security Provider Configuration' 10. Beneath 'Audit Service' section, click 'Configure' button 11. Set the values for the IAU_APPEND schema and save configuration 12. Repeat steps 2-7 for data source named 'wls-wldf-storeDS' and WLS schema

Fix Text (F-39132r628627_fix)

1. Access AC
2. From 'Domain Structure', select 'Services' -> 'Data Sources'
3. Utilize 'Change Center' to create a new change session
4. Click 'New' data source to create a new data source for the audit data store using schema IAU_APPEND
5. Enter database details and JNDI name, click through wizard
6. Select all servers and clusters available as targets to deploy this data source to
7. Finish creating the data source and record the JNDI name
8. Access EM
9. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'Security' -> 'Security Provider Configuration'
10. Beneath 'Audit Service' section, click 'Configure' button
11. Set the values for the IAU_APPEND schema and save configuration
12. Repeat steps 2-7 for data source named 'wls-wldf-storeDS' and WLS schema