Hardening Connections – Part 1: IBM HTTP Server

by Christoph Stoettner
Read in about 2 min · (words)

Fountain pen and a notebook

Photo by Aaron Burden | Unsplash

Preamble

Before i begin with my securing article, i want to say something on security on IBM Connections. Mainly i don’t like the thing, that IBM only support very special versions of software.

So we must use WebSphere 7.0.0.21, DB2 9.7.0.5, IHS 7.0.0.11 and so on. Each product had updates the last months and i think we won’t get support when we use other versions.

So i have to chances. On the first side i can update my software to limit vulnerabilities and get perhaps no support, or i will have vulerable software with support.

Just my 2 cent and i hope i will get answer, if i will get support with higher program versions.

SSL and IHS

One of our customers had a pentest the last months and had some vulnerabilities with IBM HTTP Server (IHS), which is used to access IBM Connections.

I used a 2048 Bit key for ssl which was generated with iKeyman, but the pentest doc told me, that short keys were used for encryption (smaller 112 bit). So i read a little bit.

This 2048 bit mean the public key of my hostkey. SSL uses this key to encrypt the connection between browser and webserver. Within the ssl handshake session keys are generated on basis of this hostkey. Browser and Server check which protocols are enabled on both sides and use one of the protocols both support.

You can check your SSL enabled server here: https://www.ssllabs.com/ssltest/index.html .

Information on ciphers with IHS: http://www-01.ibm.com/software/webservers/httpservers/doc/v10/ibm/9acdciph.htm

You can limit the available ciphers and protocols on your IBM HTTP Server.

First you should disable SSL v2: SSLProtocolDisable SSLv2

I configure the directives in my virtual hosts section:

Listen 0.0.0.0:443
ServerName  connections.example.com
SSLEnable
SSLProtocolDisable SSLv2
SSLCipherSpec 3A
SSLCipherSpec 34
SSLCipherSpec 35
SSLCipherSpec 2F
SSLCipherSpec 35b

Poorly TLS v1.1 and v1.2 support comes with IHS 8 and we can’t use it with IHS 7.

This is my first article on securing IHS and Connections. Next part will continue with IHS, i want to disable some parts, which comes with the default httpd.conf and are not used with connections.

Author
Add a comment
Error
There was an error sending your comment, please try again.
Thank you!
Your comment has been submitted and will be published once it has been approved.

Your email address will not be published. Required fields are marked with *

Suggested Reading
Card image cap

So up to IBM Connections 6.0 everything was allowed until it was not excluded in one of the blocklist files. This files are stored within the Deployment Manager profile/config/cells/<cellname>/LotusConnections-config/extern. Now with Connections 6.0CR1 everything is forbidden, until it is enabled in the allowlist. This concept is rolled out for widgets (homepage and communities) and active content. Active content means HTML content too. So everything you or your users add to Connections (blog-posts, wiki pages) gets filtered during the save procedure. This removes all HTML tags and attributes which are not explicitly allowed!

Read in about 5 min
Aaron Burden: Fountain pen and a notebook
You can log login errors within IBM Http Server. One way would be to get use SetEnvIf, but then you can’t get the querystring of the error page. When you type a wrong password the URL changes from https://connectionshost/application/login/ to https://connectionshost/application/login/?error=true. SetEnvIf Request_URI "/login$" log This set the environment variable to log, but when you read the Apache documentation you find: The resource requested on the HTTP request line — generally the portion of the URL following the scheme and host portion without the query string. See the RewriteCond directive of mod_rewrite for extra information on how to match your query string
Read in about 1 min
Aaron Burden: Fountain pen and a notebook
I started a new project on OpenNTF for the collection of scripts we created to speed up and simplify WebSphere and Connections Administration. Link to this project: Administration Scripts for WebSphere In the moment most of documentation is only as comment in these scripts. Descriptions can be found in Github and Slideshare . Highlights J2EE Security Role Backup and Restore Set initial Security Roles for Connections Applications (Author: Klaus Bild ) Documentation When you want to start with this collection, copy the jython script to your Deployment Manager bin-folder ($WAS_HOME/profiles/Dmgr01/bin) and call the scripts with wsadmin.
Read in about 1 min