STIGQter: STIG Summary: IBM WebSphere Liberty Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Apr 2026:

The WebSphere Liberty Server must be configured to encrypt log information.

DISA Rule

SV-250330r960951_rule

Vulnerability Number

V-250330

Group Title

SRG-APP-000126-AS-000085

Rule Version

IBMW-LS-000320

Severity

CAT II

CCI(s)

• CCI-000162 - Protect audit information from unauthorized access.
• CCI-001314 - Reveal error messages only to organization-defined personnel or roles.
• CCI-001350 - Implement cryptographic mechanisms to protect the integrity of audit information.

Weight

10

Fix Recommendation

If the system is configured to send logs to a remote ELK stack log server, (or other remote logging solution) as per requirement IBMW-LS-000230, this requirement is Not Applicable.

Signing is optional. The encrypted and/or signed audit logs are found under the ${server.config.dir}/logs directory and are named audit.log for the most recent, and audit_<timestamp>.log for any archived logs. Two keystores are recommended but not required when doing both encryption and signing (ikeyman as part of the JDK may be used) and a certificate imported into each. One keystore will contain the certificate used to encrypt the logs; the other keystore will contain the certificate used to sign the logs. The audit configuration must define the location of every keystore, their passwords, and the alias of each certificate used to encrypt and sign the logs.

1. Enable the following features:

<featureManager>
<feature>appSecurity-2.0</feature>
<feature>audit-1.0</feature>
<feature>ssl-1.0</feature>
<feature>
</featureManager>

2. Verify a keystore is configured. The following is a JKS keystore example. PKCS12 is also a viable keystore:

<keyStore
id="auditEncKeyStore"
password="ENTER THE ENCRYPTION KEYSTORE PASSWORD"
location="${server.config.dir}/resources/security/AuditEncryptionKeyStore.jks"
type="JKS" />

<keyStore
id="auditSignKeyStore"
password="ENTER THE SIGNING KEYSTORE PASSWORD"
location="${server.config.dir}/resources/security/AuditSigningKeyStore2.jks"
type="JKS" />

3. Enable auditFileHandler encryption. Signing the logs is optional.

<auditFileHandler
encrypt="true"
encryptAlias="auditencryption"
encryptKeyStoreRef="auditEncKeyStore"
sign="true"
signingAlias="auditsigning2"
signingKeyStoreRef="auditSignKeyStore">
</auditFileHandler>

Check Contents

If the system is configured to send logs to a remote ELK stack log server, as per requirement IBMW-LS-000230, (or other remote logging solution) this requirement is Not Applicable.

As a user with local file access to ${server.config.dir}/server.xml:

1. Verify the following features are configured.

<featureManager>
<feature>appSecurity-2.0</feature>
<feature>audit-1.0</feature>
<feature>ssl-1.0</feature>
</featureManager>

2. Verify a keystore is configured. The following is an example:

<keyStore
id="auditEncKeyStore"
password="ENTER THE ENCRYPTION KEYSTORE PASSWORD"
location="${server.config.dir}/resources/security/AuditEncryptionKeyStore.jks"
type="JKS" />

<keyStore
id="auditSignKeyStore"
password="ENTER THE SIGNING KEYSTORE PASSWORD"
location="${server.config.dir}/resources/security/AuditSigningKeyStore2.jks"
type="JKS" />

3. Verify auditFileHandler encryption is enabled. Signing is optional.

<auditFileHandler
encrypt="true"
encryptAlias="auditencryption"
encryptKeyStoreRef="auditEncKeyStore"
sign="true"
signingAlias="auditsigning2"
signingKeyStoreRef="auditSignKeyStore">
</auditFileHandler>

If the features and keystore are not configured, and encryption is not enabled, this is a finding.

Vulnerability Number

V-250330

Documentable

False

Rule Version

IBMW-LS-000320

Severity Override Guidance

If the system is configured to send logs to a remote ELK stack log server, as per requirement IBMW-LS-000230, (or other remote logging solution) this requirement is Not Applicable.

As a user with local file access to ${server.config.dir}/server.xml:

1. Verify the following features are configured.

<featureManager>
<feature>appSecurity-2.0</feature>
<feature>audit-1.0</feature>
<feature>ssl-1.0</feature>
</featureManager>

2. Verify a keystore is configured. The following is an example:

<keyStore
id="auditEncKeyStore"
password="ENTER THE ENCRYPTION KEYSTORE PASSWORD"
location="${server.config.dir}/resources/security/AuditEncryptionKeyStore.jks"
type="JKS" />

<keyStore
id="auditSignKeyStore"
password="ENTER THE SIGNING KEYSTORE PASSWORD"
location="${server.config.dir}/resources/security/AuditSigningKeyStore2.jks"
type="JKS" />

3. Verify auditFileHandler encryption is enabled. Signing is optional.

<auditFileHandler
encrypt="true"
encryptAlias="auditencryption"
encryptKeyStoreRef="auditEncKeyStore"
sign="true"
signingAlias="auditsigning2"
signingKeyStoreRef="auditSignKeyStore">
</auditFileHandler>

If the features and keystore are not configured, and encryption is not enabled, this is a finding.

Check Content Reference

M

Target Key

5424