zOS Websphere Application Server for RACF STIG

zOS Websphere Application Server for RACF Security Technical Implementation Guide

The zOS Websphere Application Server for RACF Security Technical Implementation Guide (V7 R2) has 5 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

5STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V7 · R2

CurrentPublished Wed Oct 01 2025 What changed in V7R2

The WebSphere Application Server plug-in is not specified in accordance with the proper security requirements.

zOS Websphere Application Server for RACF Security Technical Implementation Guide

Assessment Title

Rule Text

The WebSphere Application Server plug-in is not specified in accordance with the proper security requirements.

Description

Discussion Text

Requests processed by the WebSphere Application Server (WAS) are dependent on directives configured in the HTTP server httpd.conf file. These directives specify critical files containing the WAS plug-in and WAS configuration. These files provide the operational and security characteristics of WAS. Failure to properly configure WAS-related directives could lead to undesirable operations and degraded security. This exposure may compromise the availability and integrity of applications and customer data.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-224550

Rule

SV-224550r1145293_rule

Severity

medium

Rule Version

ZWAS0050

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Refer to the following report produced by the z/OS Data Collection:

- USSCMDS.RPT(AHTTPD).

Collect the following information for each IBM HTTP server:

- The JCL procedure library and member name used to start each IBM HTTP server. DOC(IHSPROCS)
- For each IBM HTTP server, supply the following information: 

Web server ID defined to the ACP
Web server administration group defined to the ACP
Web server standard HFS directory

Review the HTTP server JCL procedure to determine the httpd.conf file to review.

Verify that all WAS-related directives are configured using the ServerInit, Service, and ServerTerm statements as outlined below.

The following path entries were added to the /etc/httpd.conf file for WebSphere 3.5:

ServerInit   /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:init_exit /usr/lpp/WebSphere/etc/WebSphere/AppServer/properties/was.conf
Service   /webapp/examples/* /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service   /*.jhtml /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service   /*.shtml /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service   /servlet/* /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service   /*.jsp /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
ServerTerm   /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:term_exit

The following path entries are added to the /etc/httpd.conf file for WebSphere 4.0.1:

ServerInit -    /usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:init_exit
Service -    /usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:service_exit
ServerTerm -    /usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:term_exit

Note: The /etc/WebSphere clause for ServerInit matches the directory name above where the site customization was.conf file was established.

Specific items to review include proper path, was.conf, and plug-in settings.

If all WAS-related directives are configured properly, this is not a finding.

Implementation Procedure

Fix Text

The ISSO will ensure that the WebSphere Application Server directives in the httpd.conf file are configured as outlined below.

Ensure that all WAS-related directives are configured using the ServerInit, Service, and ServerTerm statements as outlined below.

The following path entries were added to the /etc/httpd.conf file for WebSphere 3.5:
ServerInit /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:init_exit /usr/lpp/WebSphere/etc/WebSphere/AppServer/properties/was.conf 
Service /webapp/examples/* /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit 
Service /*.jhtml /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /*.shtml /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit 
Service /servlet/* /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit 
Service /*.jsp /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit ServerTerm /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:term_exit 

The following path entries are added to the /etc/httpd.conf file for WebSphere 4.0.1:
 
ServerInit -/usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:init_exit
Service - /usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:service_exit 
ServerTerm - /usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:term_exit

Note: The /etc/WebSphere clause for ServerInit matches the directory name above where the site customization was.conf file was established. Specific items to review include proper path, was.conf, and plug-in settings.

STIG check 5 of 5 in the zOS Websphere Application Server for RACF STIG checklist

← Previous · V-224549Vendor-supplied user accounts for the WebSphere Application Server must be defined to the ACP.