STIGQter: STIG Summary: IBM WebSphere Liberty Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Apr 2026:

The WebSphere Liberty Server must use TLS-enabled LDAP.

DISA Rule

SV-250337r961029_rule

Vulnerability Number

V-250337

Group Title

SRG-APP-000172-AS-000120

Rule Version

IBMW-LS-000450

Severity

CAT I

CCI(s)

• CCI-000197 - For password-based authentication, transmit passwords only cryptographically-protected channels.

Weight

10

Fix Recommendation

To ensure the Liberty Server transmits only encrypted passwords, the ${server.config.dir}/server.xml must be configured as follows:

<featureManager>
<feature>appSecurity-2.0</feature>
<feature>ssl-1.0</feature>
<feature>ldapRegistry-3.0</feature>
</featureManager>

<ldapRegistry id="ldap" realm="SampleLdapRealm" host="${ldap.server.name}" port="${ldap.server.port}" ignoreCase="true"
baseDN="${ldap.server.base.dn}"
bindDN="${ldap.server.bind.dn}’
bindPassword="${ldap.server.bind.password}"
sslEnabled="true"
sslRef="LDAPTLSSettings"
ldapType="${ldap.vendor.type}"
searchTimeout="8m">
</ldapRegistry>

<sslDefault sslRef="LDAPTLSSettings" />
<ssl id="LDAPTLSSettings" keyStoreRef="LDAPKeyStore" trustStoreRef="LDAPTrustStore"
sslProtocol="TLSv1.2"
/>
<keyStore id="LDAPKeyStore" location="${server.config.dir}/LdapSSLKeyStore.jks" type="JKS" password="{xor}CDo9Hgw=" />
<keyStore id="LDAPTrustStore" location="${server.config.dir}/LdapTLSTrustStore.jks" type="JKS" password="{xor}CDo9Hgw=" />

Check Contents

As a user with local file access to ${server.config.dir}/server.xml, verify TLS-enabled LDAP is in use. If TLS-Enabled LDAP is not defined within server.xml, this is a finding.

<featureManager>
<feature>appSecurity-2.0</feature>
<feature>ssl-1.0</feature>
<feature>ldapRegistry-3.0</feature>
</featureManager>

<ldapRegistry id="ldap" realm="SampleLdapRealm" host="${ldap.server.name}" port="${ldap.server.port}" ignoreCase="true"
baseDN="${ldap.server.base.dn}"
bindDN="${ldap.server.bind.dn}’
bindPassword="${ldap.server.bind.password}"
sslEnabled="true"
sslRef="LDAPTLSSettings"
ldapType="${ldap.vendor.type}"
searchTimeout="8m">
</ldapRegistry>

<sslDefault sslRef="LDAPTLSSettings" />
<ssl id="LDAPTLSSettings" keyStoreRef="LDAPKeyStore" trustStoreRef="LDAPTrustStore"
sslProtocol="TLSv1.2"/>
<keyStore id="LDAPKeyStore" location="${server.config.dir}/LdapSSLKeyStore.jks" type="JKS" password="{xor}CDo9Hgw=" />
<keyStore id="LDAPTrustStore" location="${server.config.dir}/LdapTLSTrustStore.jks" type="JKS" password="{xor}CDo9Hgw=" />

Vulnerability Number

V-250337

Documentable

False

Rule Version

IBMW-LS-000450

Severity Override Guidance

As a user with local file access to ${server.config.dir}/server.xml, verify TLS-enabled LDAP is in use. If TLS-Enabled LDAP is not defined within server.xml, this is a finding.

<featureManager>
<feature>appSecurity-2.0</feature>
<feature>ssl-1.0</feature>
<feature>ldapRegistry-3.0</feature>
</featureManager>

<ldapRegistry id="ldap" realm="SampleLdapRealm" host="${ldap.server.name}" port="${ldap.server.port}" ignoreCase="true"
baseDN="${ldap.server.base.dn}"
bindDN="${ldap.server.bind.dn}’
bindPassword="${ldap.server.bind.password}"
sslEnabled="true"
sslRef="LDAPTLSSettings"
ldapType="${ldap.vendor.type}"
searchTimeout="8m">
</ldapRegistry>

<sslDefault sslRef="LDAPTLSSettings" />
<ssl id="LDAPTLSSettings" keyStoreRef="LDAPKeyStore" trustStoreRef="LDAPTrustStore"
sslProtocol="TLSv1.2"/>
<keyStore id="LDAPKeyStore" location="${server.config.dir}/LdapSSLKeyStore.jks" type="JKS" password="{xor}CDo9Hgw=" />
<keyStore id="LDAPTrustStore" location="${server.config.dir}/LdapTLSTrustStore.jks" type="JKS" password="{xor}CDo9Hgw=" />

Check Content Reference

M

Target Key

5424