V-250339

Discussion

Application servers must use and meet requirements of the DOD Enterprise PKI infrastructure for application authentication. Encryption is only as good as the encryption modules used. Unapproved cryptographic module algorithms cannot be verified or relied upon to provide confidentiality or integrity, and DOD data may be compromised due to weak algorithms. The use of TLS provides confidentiality of data in transit between the application server and client. TLS must be enabled and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems.

Check Content

Note: If FIPS 140-3 is configured in IBMW-LS-001200, then this is Not Applicable.

There are two ways to meet this requirement. Only one method is required.

If IBM JDK 8 is installed and configured to run with WebSphere Liberty, proceed with method (I).

If IBM Semeru Runtimes version 11 and above is installed and configured with WebSphere Liberty, proceed with method (II). Currently IBM Semeru supports FIPS on RedHat Enterprise Linux.

Method (I) IBM JDK 8 is configured to run with WebSphere Liberty:

1. Review the ${server.config.dir}/jvm.options file. Verify FIPS is in use by checking the following lines:
 
Dcom.ibm.jsse2.usefipsprovider=true 
Dcom.ibm.jsse2.usefipsProviderName=IBMJCEPlusFIPS

If the properties are not set as shown in the ${server.config.dir}/jvm.options file, this is a finding.

2. Open ${JAVA_HOME}/jre/lib/security/java.security file. Locate the list of cryptographic providers and confirm the following entries in the provider list:

com.ibm.jsse2.IBMJSSEProvider2
com.ibm.crypto.plus.provider.IBMJCEPlusFIPS
com.ibm.crypto.provider.IBMJCE
com.ibm.crypto.plus.provider.IBMJCEPlus

If the entries are not set as shown in the ${JAVA_HOME}/jre/lib/security/java.security file, this is a finding.

Method (II) Semeru Runtimes version 11 and above is installed and configured with WebSphere Liberty. Requires RedHat Enterprise Linux as the Host Operating System.

1. Run the following command on the RedHat Enterprise Linux. Verify FIPS mode is enabled. 
# fips-mode-setup --check
If FIPS mode is not enabled, this is a finding.
 
2. Review the ${server.config.dir}/jvm.options file. Verify "semeru.fips" property is set to true. 
Dsemeru.fips=true
If the property is not set as shown in the ${server.config.dir}/jvm.options file, this is a finding.

3. Confirm NSS packages are installed by running "# dnf install nss" in a terminal.

# dnf install nss
Updating Subscription Management repositories.
Last metadata expiration check: 0:56:30 ago on Wed 13 Sep 2023 07:29:35 AM PDT.
Package nss-3.79.0-11.el8_7.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!

If the command does not return output stating NSS is installed, this is a finding.

4. Confirm NSS Database has the keystore imported by running "# certutil -L -d /etc/pki/nssdb" in a terminal. 

# certutil -L -d /etc/pki/nssdb
Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI
default                                                      CTu,Cu,Cu

If the command does not return the results as shown, this is a finding.

5. Review the ${server.config.dir}/server.xml and confirm the following entries:

name = NSS-FIPS
library = /usr/lib64/libsoftokn3.so
slot = 3
showInfo = true

If the entries are not set as shown in the ${server.config.dir}/server.xml file, this is a finding.

6. Review the ${server.config.dir}/server.xml file with the following steps:

6.1 Locate <ssl> configuration that is specifying the default SSL configuration for Liberty.
6.2 Locate the "keyStoreRef" attribute in the <ssl> configuration and find the referenced <keyStore> configuration. 
6.3 Verify the "provider" attribute is set to either "SunPKCS11-NSS-FIPS" or "PKCS11-NSS-FIPS" in the <keyStore> configuration. 
6.4 Verify the "type" attribute is set to "PKCS11".
6.5 Verify the "fileBased" attribute is set to "false".
6.6 Find the "location" attribute for the configuration file of NSS keystore database (In the example below, it is "/tmp/pkcs11cfg.cfg").
6.7 Verify the file is in a location accessible to Liberty.

Snippet of server.xml:
<ssl id="defaultSSLConfig" keyStoreRef="defaultKeyStore" sslProtocol="TLSv1.2" />
<keyStore id="defaultKeyStore" password="{xor}Lz4sLCgwLTsINis3" location="/tmp/pkcs11cfg.cfg" type="PKCS11" fileBased="false" provider="SunPKCS11-NSS-FIPS" />

If the entries are not set as shown in the ${server.config.dir}/server.xml file, this is a finding.