STIGQter: STIG Summary: zOS WebSphere Application Server for ACF2 Security Technical Implementation Guide Version: 7 Release: 2 Benchmark Date: 01 Oct 2025:

The WebSphere Application Server plug-in is not specified in accordance with the proper security requirements.

DISA Rule

SV-224353r1141681_rule

Vulnerability Number

V-224353

Group Title

SRG-OS-000033

Rule Version

ZWAS0050

Severity

CAT II

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
• CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.
• CCI-001762 - Disable or remove organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure.

Weight

10

Fix Recommendation

The ISSO will ensure that the WebSphere Application Server directives in the httpd.conf file are configured as outlined below.

Ensure that all WAS-related directives are configured using the ServerInit, Service, and ServerTerm statements as outlined below.

The following path entries were added to the /etc/httpd.conf file for WebSphere 3.5:

ServerInit /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:init_exit /usr/lpp/WebSphere/etc/WebSphere/AppServer/properties/was.conf
Service /webapp/examples/* /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /*.jhtml /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /*.shtml /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /servlet/* /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /*.jsp /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit ServerTerm /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:term_exit

The following path entries are added to the /etc/httpd.conf file for WebSphere 4.0.1:

ServerInit -/usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:init_exit
Service - /usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:service_exit
ServerTerm - /usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:term_exit

Note: The /etc/WebSphere clause for ServerInit matches the directory name above where the site customization was.conf file was established. Specific items to review include proper path, was.conf, and plug-in settings.

Check Contents

Refer to the following report produced by the z/OS Data Collection:

- USSCMDS.RPT(AHTTPD).

Collect the following information for each IBM HTTP server:

- The JCL procedure library and member name used to start each IBM HTTP server. DOC(IHSPROCS)
- For each IBM HTTP server, supply the following information:

Web server ID defined to the ACP
Web server administration group defined to the ACP
Web server standard HFS directory

Review the HTTP server JCL procedure to determine the httpd.conf file to review.

If all WAS-related directives are configured using the ServerInit, Service, and ServerTerm statements as outlined below, this is not a finding.

The following path entries were added to the /etc/httpd.conf file for WebSphere 3.5:

ServerInit /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:init_exit /usr/lpp/WebSphere/etc/WebSphere/AppServer/properties/was.conf
Service /webapp/examples/* /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /*.jhtml /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /*.shtml /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /servlet/* /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /*.jsp /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
ServerTerm /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:term_exit

The following path entries are added to the /etc/httpd.conf file for WebSphere 4.0.1:

ServerInit - /usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:init_exit
Service - /usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:service_exit
ServerTerm - /usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:term_exit

Note: The /etc/WebSphere clause for ServerInit matches the directory name above where the site customization was.conf file was established.

Specific items to review include proper path, was.conf, and plug-in settings.

Vulnerability Number

V-224353

Documentable

False

Rule Version

ZWAS0050

Severity Override Guidance

Refer to the following report produced by the z/OS Data Collection:

- USSCMDS.RPT(AHTTPD).

Collect the following information for each IBM HTTP server:

- The JCL procedure library and member name used to start each IBM HTTP server. DOC(IHSPROCS)
- For each IBM HTTP server, supply the following information:

Web server ID defined to the ACP
Web server administration group defined to the ACP
Web server standard HFS directory

Review the HTTP server JCL procedure to determine the httpd.conf file to review.

If all WAS-related directives are configured using the ServerInit, Service, and ServerTerm statements as outlined below, this is not a finding.

The following path entries were added to the /etc/httpd.conf file for WebSphere 3.5:

ServerInit /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:init_exit /usr/lpp/WebSphere/etc/WebSphere/AppServer/properties/was.conf
Service /webapp/examples/* /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /*.jhtml /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /*.shtml /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /servlet/* /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /*.jsp /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
ServerTerm /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:term_exit

The following path entries are added to the /etc/httpd.conf file for WebSphere 4.0.1:

ServerInit - /usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:init_exit
Service - /usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:service_exit
ServerTerm - /usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:term_exit

Note: The /etc/WebSphere clause for ServerInit matches the directory name above where the site customization was.conf file was established.

Specific items to review include proper path, was.conf, and plug-in settings.

Check Content Reference

M

Target Key

4132