STIGQter: STIG Summary: IBM WebSphere Liberty Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Apr 2026:

The WebSphere Liberty Server must store only encrypted representations of user passwords.

DISA Rule

SV-250336r1015470_rule

Vulnerability Number

V-250336

Group Title

SRG-APP-000171-AS-000119

Rule Version

IBMW-LS-000440

Severity

CAT I

CCI(s)

• CCI-004062 - For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.
• CCI-002475 - Implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information when at rest on organization-defined system components.
• CCI-002476 - Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined information at rest on organization-defined system components.

Weight

10

Fix Recommendation

For additional information regarding the use of the SecurityUtility command, refer to IBM’s website:
https://www.ibm.com/docs/en/was-liberty/base?topic=applications-securityutility-command

Create a new xml file with file permissions of 660.

File owner and group membership is the same as the WebSphere Liberty server user.

Add the following line to the new xml file:

<variable name="wlp.password.encryption.key" value="mysecret"/>

In the above, "mysecret" is the passphrase selected to create a cryptographic hash that represents the password.

Save the file to a secured location. Note the path and name, as it will be needed when updating server.xml.

Edit the server.xml file and add the following line:

<include location="/path/<xml file created>" />

For every unencrypted password in server.xml, run the following SecurityUtility command, which can be found in the Liberty Server install path:

SecurityUtility encode --encoding=aes

This will prompt the user to enter the plain-text password stored within the server.xml file.

The SecurityUtility tool will generate an AES cryptographic hash of the password.

Copy and replace the plain-text password with the hashed value.

This must be done for every plain-text password in server.xml.

Restart the server by entering:
server stop <server name>
server start <server name>

Check Contents

As a privileged user with file access to ${server.config.dir}/server.xml, review and ensure there are no clear-text passwords stored within the server.xml file.

If any passwords appear in plain text, or if any passwords start with {xor}, this is a finding.

Vulnerability Number

V-250336

Documentable

False

Rule Version

IBMW-LS-000440

Severity Override Guidance

As a privileged user with file access to ${server.config.dir}/server.xml, review and ensure there are no clear-text passwords stored within the server.xml file.

If any passwords appear in plain text, or if any passwords start with {xor}, this is a finding.

Check Content Reference

M

Target Key

5424