Detections
Analytics

OH12-1X-000296 - OHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to implement required cryptographic protections using cryptographic modules complying with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when encrypting data that must be compartmentalized - SSLEngine

Information

Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data.

Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.

NSA has developed Type 1 algorithms for protecting classified information. The Committee on National Security Systems (CNSS) National Information Assurance Glossary (CNSS Instruction No. 4009) defines Type 1 products as:
'Cryptographic equipment, assembly or component classified or certified by NSA for encrypting and decrypting classified and sensitive national security information when appropriately keyed. Developed using established NSA business processes and containing NSA-approved algorithms are used to protect systems requiring the most stringent protection mechanisms.'

Although persons may have a security clearance, they may not have a 'need-to-know' and are required to be separated from the information in question. The web server must employ NSA-approved cryptography to protect classified information from those individuals who have no 'need-to-know' or when encryption of compartmentalized data is required by data classification.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

1. Open every .conf file (e.g., ssl.conf) included in $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/httpd.conf with an editor that requires an SSL-enabled '<VirtualHost>' directive.
Note: Does not apply to admin.conf.
2a. Search for the 'SSLEngine' directive at the OHS server, virtual host, and/or directory configuration scopes.
2b. Set the 'SSLEngine' directive to 'On', add the directive if it does not exist.
3a. Search for the 'SSLProtocol' directive at the OHS server configuration, virtual host, and/or directory levels.
3b. Set the 'SSLProtocol' directive to 'TLSv1.2 TLSv1.1', add the directive if it does not exist.
4a. Search for the 'SSLWallet' directive at the OHS server configuration, virtual host, and/or directory levels.
4b. Set the 'SSLWallet' directive to the location (i.e., folder within $DOMAIN_HOME/config/fmwconfig/components/OHS/instances/<componentName>/keystores) of the Oracle wallet created via orapki with AES Encryption (-compat_v12 parameters) that contains only the identity certificate for the host and DoD Certificate Authorities, add the directive if it does not exist.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_HTTP_Server_12-1-3_V1R6_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-8(2), CAT|I, CCI|CCI-002450, Rule-ID|SV-79003r2_rule, STIG-ID|OH12-1X-000296, Vuln-ID|V-64513

Plugin: Unix

Control ID: a10d4f844d0d995617eaa52862d9839316cd7947a8c54b93f2e0031e29da8a81