Enabling SP800-131a for IBM Tivoli Monitoring

In the Manage Tivoli Enterprise Monitoring Services window, right-click the component and click Advanced → Edit Variables. Alternatively, you can edit the KBBENV file and the KXXENV file for each monitoring agent (where XX is your 2 letter product code) directly.

Edit the ms.ini on the monitoring server, and *.ini for each monitoring agent.

If using autonomous agents, you must add the KDEBE_FIPS_MODE_ENABLED variable to your custom environment file.

See the Communications Server IP Configuration Guide in the Communication Server Information Center for further reference.

The following is an example of an AT-TLS policy for SP800-131a:

TTLSGroupAction             group_action0
{
  TTLSEnabled               ON  
}
TTLSEnvironmentAction       environment_action0
{
  TTLSKeyRingParms
	{
    Keyring                 /etc/itm/at-tls/keyring.db
    keyringPw               itm
    keyringStashFile        /etc/itm/at-tls/keyring.sth
	}
  HandshakeRole             Client 
  TTLSEnvironmentAdvancedParms
  {
   SSLv2 Off
   SSLv3 Off
   TLSv1 Off
   TLSv1.1 Off
   TLSv1.2 On  
   FIPS140 On
   CertificateLabel IBM_Tivoli_Monitoring_Encryption_Key
  }
		TTLSSignatureParmsRef
  {
			## TLS_SIGALG_SHA224_WITH_RSA	
    SignaturePair 0301
			## TLS_SIGALG_SHA224_WITH_ECDSA
    SignaturePair 0303
			## TLS_SIGALG_SHA256_WITH_RSA
    SignaturePair 0401
			## TLS_SIGALG_SHA256_WITH_ECDSA	
    SignaturePair 0403
			## TLS_SIGALG_SHA384_WITH_RSA
    SignaturePair 0501
			## TLS_SIGALG_SHA384_WITH_ECDSA
    SignaturePair 0503
			## TLS_SIGALG_SHA512_WITH_RSA
    SignaturePair 0601
			## TLS_SIGALG_SHA512_WITH_ECDSA
    SignaturePair 0603
 	}
}

In the Manage Tivoli Enterprise Monitoring Services window, right-click the component and click Advanced → Edit Variables. Alternatively, you can edit the KFWENV file directly.

Edit the cq.ini file.

1. Follow the instructions in Starting the TEPS/e administration console.
2. Click Security → SSL certificate and key management → Manage FIPS.
3. If you have not imported compliant certificates, select Convert Certificates. When converting the certificates, select Algorithm Strict and then select SHA256WithRSA or another algorithm. If you select an ECDSA Certificate algorithm, then all browsers and clients (including the Dashboard Application Services Hub servers) connecting to the WebSphere Server must support TLSv1.2 and Elliptic Curve Certificates.

   You must accept the new certificate using the WebSphere command line utilities. Run one of the following commands, and then when prompted, accept the certificate:

   updateTEPSEPass.bat wasadmin <password>

   updateTEPSEPass.sh wasadmin <password>

4. Select Enable SP800-131 , Transistion, and Update SSL configurations to require TLSv1.2.

   Note: Once you apply and then save your changes to the master file for WebSphere, you might need to reconnect to the WebSphere console if you are logged out, since the new certificate and algorithms take effect immediately.

5. Update the ssl.client.props file to allow administration of WebSphere.

   install_dir\CNPSJ\profiles\ITMProfile\properties\ssl.client.props

   install_dir/arch/iw/profiles/ITMProfile/properties/ssl.client.props

   Once the server is configured for SP800-131 transition mode, the ssl.client.props file must be modified so that the administrative client can communicate with the WebSphere server running in SP800-131 mode. They are not able to make a TLSv1.2 connection to the server without the change. Edit the ssl.client.props file by completing the following steps:

   1. Modify com.ibm.security.useFIPS to be set to true.
   2. Add com.ibm.websphere.security.FIPSLevel=SP800-131 directly beneath the useFips property.
   3. Change the com.ibm.ssl.protocol property to TLSv1.2. Note: The com.ibm.ssl.protocol property is further down in the file than the first two properties.

For further instruction, see "Transitioning WebSphere Application Server to the SP800-131 security standard" in the WebSphere Application Server V8.5 Information Center.

install_dir\IHS\CONF

<VirtualHost *:15201>
   DocumentRoot "<ITM_HOME>/CNB"
   SSLEnable
   SSLProtocolDisable SSLv2
   SSLProtocolDisable SSLv3
   SSLProtocolEnable TLSv10
   SSLProtocolDisable TLSv11
   SSLProtocolEnable TLSv12
   SSLFIPSEnable
   SSLAttributeSet 245 "GSK_TLS_SIGALG_RSA_WITH_SHA224,
GSK_TLS_SIGALG_RSA_WITH_SHA256,GSK_TLS_SIGALG_RSA_WITH_SHA384,
GSK_TLS_SIGALG_RSA_WITH_SHA512,GSK_TLS_SIGALG_ECDSA_WITH_SHA224,
GSK_TLS_SIGALG_ECDSA_WITH_SHA256,GSK_TLS_SIGALG_ECDSA_WITH_SHA384,
GSK_TLS_SIGALG_ECDSA_WITH_SHA512" BUFF
  
  SSLServerCert IBM_Tivoli_Monitoring_Certificate
   ErrorLog "<ITH_HOME>/IHS/logs/sslerror.log"
   TransferLog "<ITM_HOME>/IHS/logs/sslaccess.log"
   KeyFile "<ITM_HOME>/keyfiles/keyfile.kdb"
   SSLStashfile "<ITM_HOME>/keyfiles/keyfile.sth"
</VirtualHost>

install_dir/arch/iu/ihs/HTTPServer/conf

<VirtualHost *:15201>
   DocumentRoot "<ITM_HOME>/<arch>/cw/"
   SSLEnable
   SSLProtocolDisable SSLv2
   SSLProtocolDisable SSLv3
   SSLProtocolEnable TLSv10
   SSLProtocolDisable TLSv11
   SSLProtocolEnable TLSv12
   SSLFIPSEnable
   SSLAttributeSet 245 "GSK_TLS_SIGALG_RSA_WITH_SHA224,
GSK_TLS_SIGALG_RSA_WITH_SHA256,GSK_TLS_SIGALG_RSA_WITH_SHA384,
GSK_TLS_SIGALG_RSA_WITH_SHA512,GSK_TLS_SIGALG_ECDSA_WITH_SHA224,
GSK_TLS_SIGALG_ECDSA_WITH_SHA256,GSK_TLS_SIGALG_ECDSA_WITH_SHA384,
GSK_TLS_SIGALG_ECDSA_WITH_SHA512" BUFF
  
  SSLServerCert IBM_Tivoli_Monitoring_Certificate
   ErrorLog "<ITM_HOME>/<arch>/iu/ihs/HTTPServer/logs/sslerror.log"
   TransferLog "<ITM_HOME>/<arch>/iu/ihs/HTTPServer/logs/sslaccess.log"
   KeyFile "<ITM_HOME>/keyfiles/keyfile.kdb"
   SSLStashfile "<ITM_HOME>/keyfiles/keyfile.sth"
</VirtualHost>

install_dir\IHSPlugins\config\ITMWebServer\plugin-cfg.xml

install_dir/arch/iu/ihs/Plugins/config/ITMWebServer/plugin-cfg.xml

• FIPSEnable set to "true"
• StrictSecurity set to "true"

• For desktop clients, your edits modify the cnp.bat file.
• For browser clients, your edits modify the applet.html file.
• For WebStart clients, your edits modify the tep.jnlpt file.