STIGQter: STIG Summary: IBM WebSphere Liberty Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Apr 2026:

Multifactor authentication for network access to privileged accounts must be used.

DISA Rule

SV-250335r1015469_rule

Vulnerability Number

V-250335

Group Title

SRG-APP-000149-AS-000102

Rule Version

IBMW-LS-000390

Severity

CAT I

CCI(s)

• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.
• CCI-000765 - Implement multifactor authentication for network access to privileged accounts.
• CCI-002009 - Accept Personal Identity Verification-compliant credentials from other federal agencies.
• CCI-002010 - Electronically verify Personal Identity Verification-compliant credentials from other federal agencies.

Weight

10

Fix Recommendation

Refer to IBM documentation on how to configure TLS and client based certificate authentication for additional configuration details. The following is a summary list of items needed to configure the system for certificate based authentication. Production systems and installations will vary.

The application’s web.xml file must be configured to use client certs.

EXAMPLE:
<login-config>
<auth-method>CLIENT-CERT</auth-method>
</login-config>

The server.xml features must be configured to use transportSecurity and an ldap configuration.

<featureManager>
<feature>appSecurity-2.0</feature>
<feature>ldapRegistry-3.0</feature>
<feature>transportSecurity-1.0</feature>
</featureManager>

The server.xml TLS and LDAP settings must be configured. The following is an EXAMPLE only. "Default" verbiage and keystore information in the below SSL configuration will be different in production systems.

<!-- default SSL configuration is defaultSSLSettings -->
<sslDefault sslRef="defaultSSLSettings" />
<ssl id="defaultSSLSettings" keyStoreRef="defaultKeyStore" sslProtocol="SSL_TLSv2" trustStoreRef="defaultTrustStore"
clientAuthentication="true"/>

<keyStore id="defaultKeyStore" location="key.jks" type="JKS" password="defaultPWD" />
<keyStore id="defaultTrustStore" location="key.jks" type="JKS" password="defaultPWD" />

Configure LDAP certificate filter settings according the certificates being used.

<ldapRegistry id="ldap" realm="SampleLdapRealm" host="${ldap.server.name}" port="${ldap.server.port}" ignoreCase="true"
baseDN="${ldap.server.base.dn}"
ldapType="${ldap.vendor.type}"
certificateMapMode="Certificate_Filter" or "Exact_DN"
certificateFilter="${your certificate mapping}"
searchTimeout="8m"
sslEnabled="true">
</ldapRegistry>

Check Contents

As a user with local file access to ${server.config.dir}/server.xml file, verify the TLS connection used for managing the server is configured to use clientAuthentication.

<featureManager>
<feature>appSecurity-2.0</feature>
<feature>ldapRegistry-3.0</feature>
<feature>transportSecurity-1.0</feature>
</featureManager>

Verify the TLS connection used for managing the server is configured to use clientAuthentication. The following is used as an example.

If the clientAuthentication setting for the TLS management application is not set to "true", this is a finding.

EXAMPLE:
<!-- default SSL configuration is defaultSSLSettings -->
<sslDefault sslRef="defaultSSLSettings" />
<ssl id="defaultSSLSettings" keyStoreRef="defaultKeyStore" sslProtocol="SSL_TLSv2" trustStoreRef="defaultTrustStore"
clientAuthentication="true"/>

Access the web management interface via a web browser and verify TLS secured connectivity to the web based management application.

Vulnerability Number

V-250335

Documentable

False

Rule Version

IBMW-LS-000390

Severity Override Guidance

As a user with local file access to ${server.config.dir}/server.xml file, verify the TLS connection used for managing the server is configured to use clientAuthentication.

<featureManager>
<feature>appSecurity-2.0</feature>
<feature>ldapRegistry-3.0</feature>
<feature>transportSecurity-1.0</feature>
</featureManager>

Verify the TLS connection used for managing the server is configured to use clientAuthentication. The following is used as an example.

If the clientAuthentication setting for the TLS management application is not set to "true", this is a finding.

EXAMPLE:
<!-- default SSL configuration is defaultSSLSettings -->
<sslDefault sslRef="defaultSSLSettings" />
<ssl id="defaultSSLSettings" keyStoreRef="defaultKeyStore" sslProtocol="SSL_TLSv2" trustStoreRef="defaultTrustStore"
clientAuthentication="true"/>

Access the web management interface via a web browser and verify TLS secured connectivity to the web based management application.

Check Content Reference

M

Target Key

5424