Operations and Administration Console and middleware security configuration information

Application security

In a production environment, set the following environment entries for the Operations and Administration Console (OAC) to guard against information leakage:

Set enablePerUserDebug to false.
Set enableExceptionView to false.
Set expireSessionOnLeave to yes.
Set genTableSql to false.
Set allAlertsInterval to -1.

For more information, see Environment entries and resources.

IBM WebSphere Liberty security

Consider the following security items when you are reviewing the Securing Liberty and its applications section in the WebSphere® Liberty documentation.

Restrict cookies to HTTP only

The FTM OAC creates some encrypted cookies for authentication and session management purposes. Restricting cookies to only HTTP is recommended to provide a level of defense against a client-side script that can access a protected cookie and acquire its content.

Secure the cookies that are used by FTM by configuring the cookieHttpOnly field as shown in the following XML stanzas.

<httpSession
  cookieName="JSESSIONID"
  cookieSecure="true"
  cookieHttpOnly="true"
  cookiePath="/"/>

<httpSession
  cookieName="FXHSESSIONID"
  cookieSecure="true"
  cookieHttpOnly="true"
  cookiePath="/"/>

These stanzas are in the default deployment.

Secure the JSESSIONID cookie

An HTTP session cookie might contain tokens and sensitive user information. Secure the cookies that are used by FTM by configuring the cookieSecure field as shown in the following XML stanzas.

<httpSession
  cookieName="JSESSIONID"
  cookieSecure="true"
  cookieHttpOnly="true"
  cookiePath="/"/>

<httpSession
  cookieName="FXHSESSIONID"
  cookieSecure="true"
  cookieHttpOnly="true"
  cookiePath="/"/>

These stanzas are in the default deployment.

Enable HTTPS

Enable HTTPS support for Liberty by adding the following XML to its configuration.

<featureManager>
  <feature>transportSecurity-1.0</feature>
</featureManager>

This stanza is in the default deployment.

Restrict the TLS version support to version 1.2

Restrict the TLS version for Liberty by adding the following XML to its configuration.

<ssl id="defaultSSLConfig" trustDefaultCerts="true" clientAuthenticationSupported="true" sslProtocol="TLSv1.2"/>

This stanza is in the default deployment.

The custom keystore password is defined in the following XML in the server.xml.

<keyStore id="defaultKeyStore" password="yourPassword"/>

Restrict the supported cipher suites

Remove support for the weaker encryption cipher suites. Add the cipher suites that you want Liberty to support by adding the following XML to its configuration.


<ssl id="defaultSSLConfig" 
         trustDefaultCerts="true" 
         clientAuthenticationSupported="true" 
         sslProtocol="TLSv1.2"
         enabledCiphers={List of cipher suites}

The default deployment removes some of the weaker encryption cipher suites.

Password Protection

Use one of the supported user account repositories to ensure that at least the following rules are enforced:

A strong password policy that ensures password length, complexity, reuse, and aging.
The accounts are locked out after a defined number of incorrect password attempts.

HTTP headers

HTTP response headers are delivered in responses that are sent from the server to the client browser. They can be used to enable browser restrictions to mitigate against security vulnerabilities. The following list has some of the headers that need to be considered.

Strict-Transport-Security

The HTTP Strict Transport Security (HSTS) header can be used to restrict the client and server connections to using HTTPS only. For more information, see Setting up HTTP Strict Transport Security (HSTS) in the IBM® WebSphere Liberty documentation.

X-Content-Type-Options

This header ensures that the MIME types as specified in the Content-Type header cannot be altered.

X-XSS-Protection

This header enables the cross-site scripting (XSS) filter in the browser.

Content-Security-Policy

This header can be used to modify the way that the browser renders pages. It can be configured to prevent a wide range of attacks.

X-Powered-By

To avoid revealing details about the technology used by the server, disable this header by setting the following property in the WebSphere Liberty web container settings.

<webContainer disableXPoweredBy="true"/>

For more information, see the IBM WebSphere Liberty documentation. This stanza is in the default deployment.