STIGQter STIGQter: STIG Summary: IBM WebSphere Traditional V9.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Aug 2018:

The WebSphere Application Server must be run as a non-admin user.

DISA Rule

SV-95991r1_rule

Vulnerability Number

V-81277

Group Title

SRG-APP-000141-AS-000095

Rule Version

WBSP-AS-000960

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Ensure that WAS processes are started via the specified non-privileged OS user ID when running commands such as startManager, startNode, and startServer.

If startManager and startNode are in the system startup scripts, ensure that they are not started as the root user or admin user for Windows systems.

For example, in the UNIX system, the inittab entry may look like: "was:235:respawn:/usr/WebSphere/AppServer/bin/rc.was >/dev/console 2>&1".

Ensure the user is not a root user and is instead a regular OS user.

Check Contents

Interview systems manager.

Identify the OS user ID that the WAS server runs as.

Using relevant OS commands review OS processes and search for WAS processes (running as Java).

Ensure they are running under the assigned non-administrative user id.

For UNIX: "ps -ef|grep -i websphere"

For Windows: "wmic path win32_process where "caption = 'java.exe'" get CommandLine

If the WebSphere processes are running as the root or administrator user, this is a finding.

Vulnerability Number

V-81277

Documentable

False

Rule Version

WBSP-AS-000960

Severity Override Guidance

Interview systems manager.

Identify the OS user ID that the WAS server runs as.

Using relevant OS commands review OS processes and search for WAS processes (running as Java).

Ensure they are running under the assigned non-administrative user id.

For UNIX: "ps -ef|grep -i websphere"

For Windows: "wmic path win32_process where "caption = 'java.exe'" get CommandLine

If the WebSphere processes are running as the root or administrator user, this is a finding.

Check Content Reference

M

Target Key

3399

Comments