STIGQter STIGQter: STIG Summary: Oracle WebLogic Server 12c Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

Oracle WebLogic must employ automated mechanisms to facilitate the monitoring and control of remote access methods.

DISA Rule

SV-235930r628568_rule

Vulnerability Number

V-235930

Group Title

SRG-APP-000516-AS-000237

Rule Version

WBLC-01-000011

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

1. Access AC
2. From 'Domain Structure', select 'Services' -> 'Data Sources'
3. Utilize 'Change Center' to create a new change session
4. Click 'New' data source to create a new data source for the audit data store using schema IAU_APPEND
5. Enter database details and JNDI name, click through wizard
6. Select all servers and clusters available as targets to deploy this data source to
7. Finish creating the data source and record the JNDI name
8. Access EM
9. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'Security' -> 'Security Provider Configuration'
10. Beneath 'Audit Service' section, click 'Configure' button
11. Set the values for the IAU_APPEND schema and save configuration
12. Repeat steps 2-7 for data source named 'wls-wldf-storeDS' and WLS schema

Check Contents

1. Access EM
2. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'JDBC Data Sources'
3. From the list of data sources, select the one named 'opss-audit-DBDS', which connects to the IAU_APPEND schema of the audit database. Note the value in the 'JNDI name' field.
4. To verify, select 'Configuration' tab -> 'Connection Pool' tab
5. Ensure the 'URL' and 'Properties' fields contain the correct connection values for the IAU_APPEND schema
6. To test, select 'Monitoring' tab, select a server from the list and click 'Test Data Source'. Ensure test was successful. Repeat for each server in the list.
7. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'Security' -> 'Security Provider Configuration'
8. Beneath 'Audit Service' section, click 'Configure' button
9. Ensure 'Data Source JNDI Name' value matches the JNDI Name value from data source in step 3 above
10. Repeat steps 2-6 for data source named 'wls-wldf-storeDS' and WLS schema

If the data is not being stored for access by an external monitoring tool, this is a finding.

Vulnerability Number

V-235930

Documentable

False

Rule Version

WBLC-01-000011

Severity Override Guidance

1. Access EM
2. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'JDBC Data Sources'
3. From the list of data sources, select the one named 'opss-audit-DBDS', which connects to the IAU_APPEND schema of the audit database. Note the value in the 'JNDI name' field.
4. To verify, select 'Configuration' tab -> 'Connection Pool' tab
5. Ensure the 'URL' and 'Properties' fields contain the correct connection values for the IAU_APPEND schema
6. To test, select 'Monitoring' tab, select a server from the list and click 'Test Data Source'. Ensure test was successful. Repeat for each server in the list.
7. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'Security' -> 'Security Provider Configuration'
8. Beneath 'Audit Service' section, click 'Configure' button
9. Ensure 'Data Source JNDI Name' value matches the JNDI Name value from data source in step 3 above
10. Repeat steps 2-6 for data source named 'wls-wldf-storeDS' and WLS schema

If the data is not being stored for access by an external monitoring tool, this is a finding.

Check Content Reference

M

Target Key

5282

Comments