Versions Compared

Old Version 27

changes.mady.by.user Vasilis Kleanthous (Unlicensed)

Saved on

compared with

New Version 28

changes.mady.by.user Vasilis Kleanthous (Unlicensed)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Table of Contents

This page provides some guidelines for security configuration of IBM Websphere and Wildfly application servers based on OWASP recommentations.

Management Console Security

To secure application server configuration, it is necessary to setup the users and roles that can access the application server's management console.

For more information, you can refer to https://www.owasp.org/index.php/Testing_Identity_Management

IBM Websphere

To configure IBM Websphere security, follow the directions in the link below.

http://www.ibm.com/support/knowledgecenter/SSEQTP_8.5.5/com.ibm.websphere.base.doc/ae/tsec_csec2.html

Wildfly

To configure Wildfly security, follow the directions in the link below.

https://docs.jboss.org/author/display/WFLY8/Security+Realms

HTTPS Configuration

CRM.COM application is designed to process and store customer sensitive data.

...

For more information, you can refer to https://www.owasp.org/index.php/Testing_for_Sensitive_information_sent_via_unencrypted_channels_%28OTG-CRYPST-003%29

IBM Websphere

To configure IBM Websphere for HTTPS, follow the directions in the link below.

http://www.ibm.com/support/knowledgecenter/en/ssw_i5_54/rzatz/secchttps.htm

Wildfly

To configure Wildfly for HTTPS, follow the directions in the link below.

https://docs.jboss.org/author/pages/viewpage.action?pageId=66322705

SSL/TLS Configuration

Due to known vulnerabilities, it is required to enable specific encryption protocols and cypher suites.

...

For more information, you can refer to https://www.owasp.org/index.php/Testing_for_SSL-TLS_%28OWASP-CM-001%29

IBM Websphere

To configure IBM Websphere to use TLS 1.2, check the following link.

...

http://www.ibm.com/support/knowledgecenter/linuxonibm/liaag/wascrypt/l0wscry00_wasciphersuite.htm

Wildfly

To configure Wildfly, the Undertow subsystem should be configured by adding the enabled-protocols and enabled-cipher-suites attributes in https listener as follows.

Code Block
languagexml
titlestandalone.xml
        <subsystem xmlns="urn:jboss:domain:undertow:2.0">
            <buffer-cache name="default"/>
            <server name="default-server">
                ...
				<https-listener name="default-ssl" socket-binding="https" security-realm="SslRealm" no-request-timeout="30000" enabled-cipher-suites="TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" enabled-protocols="TLSv1.2"/>
            </server>
                ...
        </subsystem>

HTTP Strict Transport Security

The HTTP Strict Transport Security (HSTS) header is a mechanism that web sites have to communicate to the web browsers that all traffic exchanged with a given domain must always be sent over https, this will help protect the information from being passed over unencrypted requests.

For more information, you can refer to https://www.owasp.org/index.php/Test_HTTP_Strict_Transport_Security_%28OTG-CONFIG-007%29

IBM Websphere

To configure IBM HTTP Server for HSTS, follow the directions in the following link.

http://www.ibm.com/support/knowledgecenter/SSAW57_8.5.5/com.ibm.websphere.ihs.doc/ihs/tihs_hsts.html

Wildfly

To configure the HSTS header on Wildfly, the Undertow subsystem should be configured by adding 2 lines in standalone.xml as follows.

Code Block
languagexml
titlestandalone.xml
        <subsystem xmlns="urn:jboss:domain:undertow:2.0">
            <buffer-cache name="default"/>
            <server name="default-server">
                <http-listener name="default" socket-binding="http" redirect-socket="https"/>
                <host name="default-host" alias="localhost">
                    ...
					<!-- Add the following line -->
 					<filter-ref name="HSTS"/>
					...
				 </host>
            </server>
            <servlet-container name="default">
                ...
            </servlet-container>
            <handlers>
                ...
            </handlers>
            <filters>
				<!-- Add the following line -->
 				<response-header name="HSTS" header-name="Strict-Transport-Security" header-value="max-age=3600"/>
            </filters>
        </subsystem>

Server Fingerprinting

Server fingerprinting is the process of identifying the Web server / technologies used.

...

To avoid server fingerprinting the following configurations should be done on the application server.

IBM Websphere

By default, IBM Websphere does not include the server name in HTTP headers.

...

https://www.ibm.com/support/knowledgecenter/SSAW57_8.5.5/com.ibm.websphere.nd.doc/ae/rweb_custom_props.html

Wildfly

Wildfly by default includes the Server and X-Powered-By headers.

...

Code Block
languagexml
titlestandalone.xml
        <subsystem xmlns="urn:jboss:domain:undertow:2.0">
            <buffer-cache name="default"/>
            <server name="default-server">
                <http-listener name="default" socket-binding="http" redirect-socket="https"/>
                <host name="default-host" alias="localhost">
                    <location name="/" handler="welcome-content"/>
					<!-- The following 2 lines should be removed -->
                    <!--filter-ref name="server-header"/-->
                    <!--filter-ref name="x-powered-by-header"/-->
                </host>
            </server>
            <servlet-container name="default">
                <jsp-config development="true"/>
                <websockets/>
            </servlet-container>
            <handlers>
                <file name="welcome-content" path="${jboss.home.dir}/welcome-content"/>
            </handlers>
            <filters>
                <response-header name="server-header" header-name="Server" header-value="WildFly/9"/>
                <response-header name="x-powered-by-header" header-name="X-Powered-By" header-value="Undertow/1"/>
            </filters>
        </subsystem>

 

Clickjacking

“Clickjacking” is a malicious technique that consists of deceiving a web user into interacting (in most cases by clicking) with something different to what the user believes they are interacting with.

For more information, you can refer to https://www.owasp.org/index.php?title=Testing_for_Clickjacking_(OTG-CLIENT-009)&setlang=en

To avoid clickjacking vulnerability, the following configurations should be done on the application server.

IBM Websphere

By default, IBM Websphere does not include the X-Frame-Options: DENY header in HTTP headers.

...

Code Block
languagebash
titleIBM Websphere HTTP Headers
Header always append X-Frame-Options DENY

Wildfly

Wildfly by default does not include the X-Frame-Options: DENY header in response headers.

...

Code Block
languagexml
titlestandalone.xml
        <subsystem xmlns="urn:jboss:domain:undertow:2.0">
            <buffer-cache name="default"/>
            <server name="default-server">
                <http-listener name="default" socket-binding="http" redirect-socket="https"/>
                <host name="default-host" alias="localhost">
                    <location name="/" handler="welcome-content"/>
					<!-- The following line should be added -->
                    <filter-ref name="X-Frame-Options"/>
                </host>
            </server>
            <servlet-container name="default">
                <jsp-config development="true"/>
                <websockets/>
            </servlet-container>
            <handlers>
                <file name="welcome-content" path="${jboss.home.dir}/welcome-content"/>
            </handlers>
            <filters>
				<!-- The following line should be added -->
                <response-header name="X-Frame-Options" header-name="X-Frame-Options" header-value="DENY"/>
            </filters>
        </subsystem>

Secure Cookies

CRM.COM application uses cookies to store session information.

...

For more information, you can refer to https://www.owasp.org/index.php/Testing_for_cookies_attributes_%28OTG-SESS-002%29

IBM Websphere

To configure secure session cookie on IBM Websphere, follow the directions in the link below.

http://www-01.ibm.com/support/docview.wss?uid=swg21427901

Wildfly

To configure secure session cookie on Wildfly, the following changes are needed in standalone.xml.

Code Block
languagexml
titlestandalone.xml
        <subsystem xmlns="urn:jboss:domain:undertow:2.0">
            <buffer-cache name="default"/>
            <server name="default-server">
                <http-listener name="default" socket-binding="http" redirect-socket="https"/>
                <host name="default-host" alias="localhost">
					...
				 </host>
            </server>
            <servlet-container name="default">
				<!-- Add the following line -->
				 <session-cookie http-only="true" secure="true"/>
            </servlet-container>
            <handlers>
                ...
            </handlers>
            <filters>
                ...
            </filters>
        </subsystem>

 

Default Applications

Some application server installations include by default applications and tools that should be disabled for maximum security.

IBM Websphere

IBM Websphere ships with some default web applications (for example Snoop Servlet).

To disable/remove these applications, login to the administrative console and go to Applications -> Application Types -> Websphere enterprise applications

Wildfly

Wildfly does not include any default applications.

Additional Resources

For additional information on security configuration of the application servers, you can refer to the following links.

IBM Websphere

http://www.ibm.com/developerworks/websphere/techjournal/1210_lansche/1210_lansche.html

Wildfly

https://docs.jboss.org/author/display/WFLY10/Security+Realms