STIGQter: STIG Summary: IBM MQ Appliance V9.0 AS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 05 Jun 2017:

Access to the MQ Appliance messaging server must utilize encryption when using LDAP for authentication.

DISA Rule

SV-89573r1_rule

Vulnerability Number

V-74899

Group Title

SRG-APP-000172-AS-000121

Rule Version

MQMH-AS-001010

Severity

CAT II

CCI(s)

• CCI-000197 - The information system, for password-based authentication, transmits only cryptographically-protected passwords.

Weight

10

Fix Recommendation

Specify LDAP as the authentication method for each queue manager.

To access the MQ Appliance CLI, enter:
mqcli

runmqsc [queue manager name]

DEFINE AUTHINFO('[Object name e.g., USE.LDAP]')
AUTHTYPE(IDPWLDAP)
CONNAME('[ldap1(port),ldap2(port),ldap3(port)]')
SECCOMM(YES) [Ensures encryption is used]
SHORTUSR('[short user name]')
CHCKCLNT(REQUIRED)
BASEDNU('base user DN')
REPLACE

ALTER QMGR CONNAUTH('[AUTHINFO object name]')
REFRESH SECURITY TYPE(CONNAUTH)

Type "end" to exit runmqsc mode.

Check Contents

To access the MQ Appliance CLI, for each queue manager, enter:
mqcli

To identify the queue managers, enter:
dspmq

For each queue manager identified, run the command:
runmqsc [queue name]

To display the active authentication object, enter:
DIS QMGR CONNAUTH

Result: QMNAME([queue mgr name]) CONNAUTH([auth object name])

DIS AUTHINFO(auth object name)

Verify that "AUTHTYPE(IDPWLDAP)", and "SECCOMM(YES)" are displayed, and that all parameters are correctly specified to use the organizationally approved LDAP server(s).

If these parameter values cannot be verified, this is a finding.

Vulnerability Number

V-74899

Documentable

False

Rule Version

MQMH-AS-001010

Severity Override Guidance

To access the MQ Appliance CLI, for each queue manager, enter:
mqcli

To identify the queue managers, enter:
dspmq

For each queue manager identified, run the command:
runmqsc [queue name]

To display the active authentication object, enter:
DIS QMGR CONNAUTH

Result: QMNAME([queue mgr name]) CONNAUTH([auth object name])

DIS AUTHINFO(auth object name)

Verify that "AUTHTYPE(IDPWLDAP)", and "SECCOMM(YES)" are displayed, and that all parameters are correctly specified to use the organizationally approved LDAP server(s).

If these parameter values cannot be verified, this is a finding.

Check Content Reference

M

Target Key

3239

Comments