Oracle® Fusion Middleware

Securing a Production Environment for Oracle WebLogic Server

11g Release 1 (10.3.1)

E13705-02

October 2009

This document describes how to secure an Oracle WebLogic Server production environment.

Oracle Fusion Middleware Securing a Production Environment for Oracle WebLogic Server, 11g Release 1 (10.3.1)

E13705-02

Copyright © 2007, 2009, Oracle and/or its affiliates. All rights reserved.

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this software or related documentation is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle USA, Inc., 500 Oracle Parkway, Redwood City, CA 94065.

This software is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure the safe use of this software. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software in dangerous applications.

Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.

This software and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

Contents

Preface

- Documentation Accessibility

- Conventions

1 Introduction and Roadmap

- Document Scope and Audience

- Guide to This Document

- Related Information

- Security Samples and Tutorials

- Avitek Medical Records Application (MedRec) and Tutorials

- Security Examples in the WebLogic Server Distribution

- New and Changed Features in This Release

2 Determining Your Security Needs

- Understand Your Environment

- Hire Security Consultants or Use Diagnostic Software

- Read Security Publications

- Install WebLogic Server in a Secure Manner

3 Ensuring the Security of Your Production Environment

- An Important Note Regarding Null Cipher Use in SSL

- New Control to Prevent Null Cipher Use

- Securing the WebLogic Server Host

- Securing Network Connections

- Securing Your Database

- Securing the WebLogic Security Service

- Securing Applications

Preface

This preface describes the document accessibility features and conventions used in this guide—Securing a Production Environment for Oracle WebLogic Server.

Documentation Accessibility

Our goal is to make Oracle products, services, and supporting documentation accessible to all users, including users that are disabled. To that end, our documentation includes features that make information available to users of assistive technology. This documentation is available in HTML format, and contains markup to facilitate access by the disabled community. Accessibility standards will continue to evolve over time, and Oracle is actively engaged with other market-leading technology vendors to address technical obstacles so that our documentation can be accessible to all of our customers. For more information, visit the Oracle Accessibility Program Web site at http://www.oracle.com/accessibility/.

Accessibility of Code Examples in Documentation

Screen readers may not always correctly read the code examples in this document. The conventions for writing code require that closing braces should appear on an otherwise empty line; however, some screen readers may not always read a line of text that consists solely of a bracket or brace.

Accessibility of Links to External Web Sites in Documentation

This documentation may contain links to Web sites of other companies or organizations that Oracle does not own or control. Oracle neither evaluates nor makes any representations regarding the accessibility of these Web sites.

Deaf/Hard of Hearing Access to Oracle Support Services

To reach Oracle Support Services, use a telecommunications relay service (TRS) to call Oracle Support at 1.800.223.1711. An Oracle Support Services engineer will handle technical issues and provide customer support according to the Oracle service request process. Information about TRS is available at http://www.fcc.gov/cgb/consumerfacts/trs.html, and a list of phone numbers is available at http://www.fcc.gov/cgb/dro/trsphonebk.html.

Conventions

The following text conventions are used in this document:

Convention

Meaning

boldface

Boldface type indicates graphical user interface elements associated with an action, or terms defined in text or the glossary.

italic

Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values.

monospace

Monospace type indicates commands within a paragraph, URLs, code in examples, text that appears on the screen, or text that you enter.

1 Introduction and Roadmap

The following sections describe the contents and organization of this guide - Securing a Production Environment.

- Document Scope and Audience

- Guide to This Document

- Related Information

- Security Samples and Tutorials

Document Scope and Audience

This guide describes how to secure a WebLogic Server production environment.

It is intended for the following audiences:

- Application Architects — Architects who, in addition to setting security goals and designing the overall security architecture for their organizations, evaluate WebLogic Server security features and determine how to best implement them. Application Architects have in-depth knowledge of Java programming, Java security, and network security, as well as knowledge of security systems and leading-edge, security technologies and tools.

- Security Developers — Developers who focus on defining the system architecture and infrastructure for security products that integrate into WebLogic Server and on developing custom security providers for use with WebLogic Server. Security Developers have a solid understanding of security concepts, including authentication, authorization, auditing (AAA), in-depth knowledge of Java (including Java Management eXtensions (JMX), and working knowledge of WebLogic Server and security provider functionality.

- Application Developers — Java programmers who develop and add security to Web applications and Enterprise JavaBeans (EJBs), and work with other engineering, quality assurance (QA), and database teams to implement security features. Application Developers have in-depth/working knowledge of Java (including Java Platform, Enterprise Edition (Java EE) Version 5 components such as servlets/JSPs and JSEE) and Java security.

- Server Administrators — Administrators who work closely with Application Architects to design a security scheme for the server and the applications running on the server, to identify potential security risks, and to propose configurations that prevent security problems. Related responsibilities may include maintaining critical production systems, configuring and managing security realms, implementing authentication and authorization schemes for server and application resources, upgrading security features, and maintaining security provider databases. Server Administrators have in-depth knowledge of the Java security architecture, including Web services, Web application and EJB security, Public Key security, SSL, and Security Assertion Markup Language (SAML).

- Application Administrators — Administrators who work with Server Administrators to implement and maintain security configurations and authentication and authorization schemes, and to set up and maintain access to deployed application resources in defined security realms. Application Administrators have general knowledge of security concepts and the Java Security architecture. They understand Java, XML, deployment descriptors, and can identify security events in server and audit logs.

Guide to This Document

This document is organized as follows:

- This chapter, Chapter 1, "Introduction and Roadmap," introduces the organization of this guide.

- Chapter 2, "Determining Your Security Needs," explains how to determine the security needs for your particular environment and describes basic measures to ensure that those needs are being met.

- Chapter 3, "Ensuring the Security of Your Production Environment," highlights essential security measures to consider before you deploy WebLogic Server into a production environment and describes how to use different security settings to secure a production environment.

Related Information

The following Oracle WebLogic Server documents contain information that is relevant to the WebLogic Security Service:

- Oracle Fusion Middleware Securing Oracle WebLogic Server - explains how to configure security for WebLogic Server and how to use Compatibility security.

- Oracle Fusion Middleware Developing Security Providers for Oracle WebLogic Server - explains how vendors and application developers can develop custom security providers that can be used with WebLogic Server.

- Oracle Fusion Middleware Understanding Security for Oracle WebLogic Server - provides an overview of the features, architecture, and functionality of the WebLogic Security Service. It is the starting point for understanding the WebLogic Security Service.

- Oracle Fusion Middleware Securing Resources Using Roles and Policies for Oracle WebLogic Server - describes how to secure WebLogic resources. It primarily focuses on securing URL (Web) and Enterprise JavaBean (EJB) resources.

- Oracle Fusion Middleware Upgrade Guide for Oracle WebLogic Server - provides procedures and other information you need to upgrade 6.x and earlier versions of WebLogic Server to WebLogic Server 9.x. It also provides information about moving applications from a 6.x or earlier version of WebLogic Server to 9.x. For specific information on upgrading WebLogic Server security, see "Upgrading a Security Provider" in Oracle Fusion Middleware Upgrade Guide for Oracle WebLogic Server.

- Oracle Fusion Middleware Oracle WebLogic Server API Reference - is reference documentation for the WebLogic security packages that are provided with and supported by this release of WebLogic Server.

Security Samples and Tutorials

Oracle provides code samples for Java Authentication and Authorization Service and for Outbound and Two-way SSL for Security developers. The examples and tutorials illustrate WebLogic Server Security in action, and provide practical instructions on how to perform key Security development tasks.

Oracle recommends that you run some or all of the Security examples before developing your own Security configurations.

Avitek Medical Records Application (MedRec) and Tutorials

MedRec is an end-to-end sample Java EE application shipped with WebLogic Server that simulates an independent, centralized medical record management system. The MedRec application provides a framework for patients, doctors, and administrators to manage patient data using a variety of different clients.

MedRec demonstrates WebLogic Server and Java EE features, and highlights Oracle-recommended best practices. MedRec is included in the WebLogic Server distribution, and can be accessed from the Start menu on Windows machines. For Linux and other platforms, you can start MedRec from the WL_HOME\samples\domains\medrec directory, where WL_HOME is the top-level installation directory for WebLogic Platform.

MedRec includes a service tier consisting primarily of Enterprise Java Beans (EJBs) that work together to process requests from Web applications, Web services, workflow applications, and future client applications. The application includes message-driven, stateless session, stateful session, and entity EJBs.

Security Examples in the WebLogic Server Distribution

WebLogic Server optionally installs API code examples in WL_HOME\samples\server\examples\src\examples, where WL_HOME is the top-level directory of your WebLogic Server installation. You can start the examples server, and obtain information about the samples and how to run them from the WebLogic Server Start menu.

New and Changed Features in This Release

For a comprehensive listing of the new WebLogic Server features introduced in this release, see Oracle Fusion Middleware What's New in Oracle WebLogic Server.

2 Determining Your Security Needs

Before you deploy WebLogic Server and your Java EE applications into a production environment, determine your security needs and make sure that you take the appropriate security measures, as described in the following sections:

- Understand Your Environment

- Hire Security Consultants or Use Diagnostic Software

- Read Security Publications

- Install WebLogic Server in a Secure Manner

Understand Your Environment

To better understand your security needs, ask yourself the following questions:

- Which resources am I protecting?
Many resources in the production environment can be protected, including information in databases accessed by WebLogic Server and the availability, performance, applications, and the integrity of the Web site. Consider the resources you want to protect when deciding the level of security you must provide.

- From whom am I protecting the resources?
For most Web sites, resources must be protected from everyone on the Internet. But should the Web site be protected from the employees on the intranet in your enterprise? Should your employees have access to all resources within the WebLogic Server environment? Should the system administrators have access to all WebLogic resources? Should the system administrators be able to access all data? You might consider giving access to highly confidential data or strategic resources to only a few well trusted system administrators. Perhaps it would be best to allow no system administrators access to the data or resources.

- What will happen if the protections on strategic resources fail?
In some cases, a fault in your security scheme is easily detected and considered nothing more than an inconvenience. In other cases, a fault might cause great damage to companies or individual clients that use the Web site. Understanding the security ramifications of each resource will help you protect it properly.

Hire Security Consultants or Use Diagnostic Software

Whether you deploy WebLogic Server on the Internet or on an intranet, it is a good idea to hire an independent security expert to go over your security plan and procedures, audit your installed systems, and recommend improvements. Oracle On Demand offers services and products that can help you to secure a WebLogic Server production environment. See the Oracle On Demand page at http://www.oracle.com/ondemand/index.html.

Read Security Publications

Read about security issues:

- For the latest information about securing Web servers, Oracle recommends the "Security Practices & Evaluations" information available from the CERT Coordination Center operated by Carnegie Mellon University at http://www.cert.org/.

- Register your WebLogic Server installation with My Oracle Support. By registering, Oracle Support will notify you immediately of any security updates that are specific to your installation. You can create a My Oracle Support account by visiting http://www.oracle.com/support/index.html.

- For security advisories, refer to the Critical Patch Updates and Security Alerts page at the following location:
http://www.oracle.com/technology/deploy/security/alerts.htm

If you have an installation of WebLogic Server 10g Release 3 (10.3) or earlier, visit the BEA Security Advisories Archive Page at http://www.oracle.com/technology/deploy/security/beaarchive.html.

Install WebLogic Server in a Secure Manner

Currently, the WebLogic Server installation includes the entire JDK and some additional WebLogic Server development utilities (for example, beasvc). These development programs could be a security vulnerability. The following are recommendations for making a WebLogic Server installation more secure:

- Do not install the WebLogic Server sample applications. When installing WebLogic Server, make sure that the option to install the Server Examples component is not selected.

- Do not run WebLogic Server when configured in development mode. Rather, you should make sure WebLogic Server is configured to run in production mode. Production mode sets the server to run with settings that are more secure and appropriate for a production environment.

Note:
When WebLogic Server is configured in development mode, certain error conditions, such as a misbehaving application or an invalid configuration of WebLogic Server, may result in a trace stack being displayed. While error responses generally are not dangerous, they have the potential to give attackers information about the application or the WebLogic Server installation that can be used for malicious purposes.

- Minimize the WebLogic Server installation by doing the following:

Note:
There is always a potential of making mistakes when deleting executables, files, and directories from the WebLogic Server installation. Therefore, Oracle recommends testing your changes in a secure, development environment before implementing them in a production environment.

- Run with the JRE instead of the Java SDK. The Javasoft SDK offers a JRE download and installation. When installing WebLogic Server, use the Configuration Wizard and select the JRE option. This option eliminates the Java compiler and other development tools.

- When using JRockit, delete the software components of the Java SDK that are not in the JRockit JRE.

- Delete development tools, such as the Configuration Wizard and the jCOM tools, if you don't plan to use them in production.

- Delete the Pointbase database which is included for evaluation purposes and it is not supported in the production environments.

3 Ensuring the Security of Your Production Environment

Oracle recommends that you implement the following actions to ensure the security of your production environment:

- Securing the WebLogic Server Host

- Securing Network Connections

- Securing Your Database

- Securing the WebLogic Security Service

- Securing Applications

An Important Note Regarding Null Cipher Use in SSL

SSL clients start the SSL handshake by connecting to the server. As part of the connection, the client sends the server a list of the cipher suites it supports.

A cipher suite is an SSL encryption method that includes the key exchange algorithm, the symmetric encryption algorithm, and the secure hash algorithm. A cipher suite is used to protect the integrity of a communication. For example, the cipher suite called RSA_WITH_RC4_128_MD5 uses RSA for key exchange, RC4 with a 128-bit key for bulk encryption, and MD5 for message digest.

The server selects a mutually-supported cipher suite from the list supplied by the client for the client and server to use for this session.

However, an incorrectly configured client might specify a set of cipher suites that contain only null ciphers.

A null cipher passes data on the wire in clear-text. (An example of a cipher suite with a null cipher is TLS_RSA_WITH_NULL_MD5.) Using a null cipher makes it possible to see the SSL messages by using a network packet sniffer. In essence, SSL is used but does not provide any security.

The server selects the null cipher only when it is the only cipher suite they have in common.

If the server selects a null cipher from the client's cipher suite list, the log contains the following message: "SSL has established a session that uses a Null cipher."

This message is output only when the server has selected a null cipher from the client's list.

Note:
If there is any potential whatsoever that an SSL client might use a null cipher to inappropriately connect to the server, you should check the log file for this message. It is recommended that new client configurations be given extra attention with respect to the use of a null cipher to ensure that they are properly configured.
It is unlikely that an existing client configuration would suddenly start using null ciphers if it had not been doing so previously. However, an existing client configuration that is unknowingly configured incorrectly could be using null ciphers.

Other SSL errors unrelated to null ciphers are possible as well, and each will display an appropriate error message in the log.

For information on configuring SSL, see "Configuring SSL" in Oracle Fusion Middleware Securing Oracle WebLogic Server. For information on viewing log files, see "View and configure logs" in the Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

New Control to Prevent Null Cipher Use

As of release 10g Release 3 (10.3), WebLogic Server includes an Administration Console control to prevent the server from using a null cipher.

The Allow Unencrypted Null Cipher control, which is available on the WebLogic Server Administration Console ServerName > Configuration > SSL > Advanced page, determines whether null ciphers are allowed. By default, this control is not set and the use of a null cipher is not allowed on the server. In such a configuration, if the SSL clients want to use the null cipher suite (by indicating TLS_RSA_WITH_NULL_MD5 as the only supported cipher suite), the SSL handshake will fail.

If you set this control, the null cipher suite (for example, TLS_RSA_WITH_NULL_MD5) is added to the list of supported cipher suites by the server. The SSL connection has a chance to use the null cipher suite if the client wants to do so. If the null cipher suite is used, the message will be unencrypted.

Caution:
Do not set this control in a production environment unless you are aware of the implications and consequences of doing so.

This control is also exposed as a system runtime parameter, weblogic.security.SSL.allowUnencryptedNullCipher, and as an AllowUnencryptedNullCipher attribute on the SSLMBean.

Securing the WebLogic Server Host

A WebLogic Server production environment is only as secure as the security of the machine on which it is running. It is important that you secure the physical machine, the operating system, and all other software that is installed on the host machine.

Note:
To enable a WebLogic Server instance to use a FIPS-compliant (FIPS 140-2) crypto module in the server's SSL implementation, make sure that the server start script (for example, startWebLogic.cmd/sh) contains the following:

- jsafeFIPS.jar is added to the PRE_CLASSPATH variable.

- The command line argument -Dweblogic.security.SSL.nojce=true is specified.

FIPS 140-2 is a standard that describes U.S. Federal government requirements for sensitive, but unclassified use.

The following are recommendations for securing a WebLogic Server host in a production environment. Also check with the manufacturer of the machine and operating system for recommended security measures.

Important:
WebLogic domain and server configuration files should be accessible only by the operating system users who configure or execute WebLogic Server.

Table 3-1 Securing the WebLogic Server Host

Security Action

Description

Physically secure the hardware.

Keep your hardware in a secured area to prevent unauthorized operating system users from tampering with the deployment machine or its network connections.

Log out of the Administration Console before navigating to a non-secure site.

If you are logged on to the WebLogic Server Administration Console, be sure to log out completely before browsing to an unknown or non-secure Web site.

Secure networking services that the operating system provides.

Have an expert review network services such as e-mail programs or directory services to ensure that a malicious attacker cannot access the operating system or system-level commands. The way you do this depends on the operating system you use.

Sharing a file system with other machines in the enterprise network imposes risks of a remote attack on the file system. Be certain that the remote machines and the network are secure before sharing the file systems from the machine that hosts WebLogic Server.

Use a file system that can prevent unauthorized access.

Make sure that the file system on each WebLogic Server host can prevent unauthorized access to protected resources. For example, on a Windows computer, use only NTFS.

Set file access permissions for data stored on disk.

Set operating system file access permissions to restrict access to data stored on disk. This data includes, but is not limited to, the following:

- The security LDAP database, which by default is in \domains\domain-name\servers\server-name\data\ldap\ldapfiles.

- The directory and filename location of a private keystore, as described in "Storing Private Keys, Digital Certificates, and Trusted Certificate Authorities" in Oracle Fusion Middleware Securing Oracle WebLogic Server.

- The directory and filename location of a Root Certificate Authority (CA) keystore, as described in "Storing Private Keys, Digital Certificates, and Trusted Certificate Authorities" in Oracle Fusion Middleware Securing Oracle WebLogic Server.

For example, operating systems such as Unix and Linux provide utilities such as umask and chmod to set the file access permissions. At a minimum, consider using "umask 066", which denies read and write permission to Group and Others.

Set file access permissions for data stored in persistent store.

- Set operating system file access permissions to restrict access to data stored in the persistent store. "Overview of the Persistent Store" in "Using the WebLogic Persistent Store" in Oracle Fusion Middleware Configuring Server Environments for Oracle WebLogic Server defines many of the WebLogic services and subsystems that can create connections to the persistent store. This list includes:

- JMS Messages. JMS Messages are described in "Understanding the Messaging Models" in Oracle Fusion Middleware Programming JMS for Oracle WebLogic Server.

- Web Services. Web Services are described in "Using Web Services Reliable Messaging" in Oracle Fusion Middleware Programming Advanced Features of JAX-RPC Web Services for Oracle WebLogic Server.

- EJB Timer services. EJB Timer services are described in "Programming the EJB Timer Service" in Oracle Fusion Middleware Programming WebLogic Enterprise JavaBeans for Oracle WebLogic Server.

- Store-and-Forward services. Store-and-Forward services are described in "Understanding the Store-and-Forward Service" in Oracle Fusion Middleware Configuring and Managing Store-and-Forward for Oracle WebLogic Server.

- JTA Transaction Log (TLOG). The JTA Transaction Log is described in "Managing Transactions" in Oracle Fusion Middleware Programming JTA for Oracle WebLogic Server.

The default persistent store maintains its data in a data\store\default directory inside the servername subdirectory of a domain's root directory.

Limit the number of user accounts on the host machine.

Avoid creating more user accounts than you need on WebLogic Server host machines, and limit the file access privileges granted to each account. On operating systems that allow more than one system administrator user, the host machine should have two user accounts with system administrator privileges and one user with sufficient privileges to run WebLogic Server. Having two system administrator users provides a back up at all times. The WebLogic Server user should be a restricted user, not a system administrator user. One of the system administrator users can always create a new WebLogic Server user if needed.

Important: WebLogic domain and server configuration files should be accessible only by the operating system users who configure or execute WebLogic Server. See the recommendation regarding creating one operating system user with access rights that are limited to WebLogic resources.

Review active user accounts regularly and when personnel leave.

Background Information: Some WebLogic Server configuration data and some URL (Web) resources, including Java Server Pages (JSPs) and HTML pages, are stored in clear text on the file system. A sophisticated user or intruder with read access to files and directories might be able to defeat any security mechanisms you establish with WebLogic Server authentication and authorization schemes.

For your system administrator user accounts, choose names that are not obvious.

For additional security, avoid choosing an obvious name such as "system", "admin", or "administrator" for your system administrator user accounts.

Safeguard passwords.

The passwords for user accounts on production machines should be difficult to guess and should be guarded carefully.

Set a policy to expire passwords periodically.

Never code passwords in client applications.

Note: Do not deploy a domain that can be accessed with the username weblogic and the password welcome1. These credentials are provided by default for domains containing the WebLogic Server sample applications, which should never be installed on a machine in a production environment. (See "Install WebLogic Server in a Secure Manner")

Do not include unencrypted passwords in command lines.

Several WebLogic Server commands, including WLST and weblogic.Deployer commands in scripts, permit you to specify unencrypted passwords in the command line. But specifying unencrypted passwords in the command line is a security risk: they can be easily viewed from the monitor screen by others, and they are displayed in process listings that log the execution of those commands.

When entering commands that require an unencrypted password, whether in a command window or script, take the following precautions to ensure that the passwords are entered securely:

- Enter passwords only when prompted. If you omit the password from the command line, you are subsequently prompted for it when the command is executed. The characters you type are not echoed.

- For scripts that start WebLogic Server instances, create a boot identity file. The boot identity file is a text file that contains user credentials for starting and stopping an instance of WebLogic Server. An Administration Server can refer to this file for user credentials instead of prompting you to provide them when the script is run. Because the credentials are encrypted, using a boot identity file is much more secure than storing unencrypted credentials in a startup or shutdown script.
In script-based Node Manager commands that start remote Administration Server instances, ensure that the remote start username and password are obtained from the Administration Server's boot identity file.

- For WLST scripts that contain commands requiring a user name and password, create a user configuration file. This file, which you can create via the WLST storeUserConfig command, contains:

- Your credentials in an encrypted form

- A key file that WebLogic Server uses to unencrypt the credentials

During WLST sessions, or in WLST scripts, the user configuration file can be passed in commands such as the following:

- connect — for connecting to a running WebLogic Server instance

- startServer — for starting the Administration Server

- nmConnect — for connecting WLST to Node Manager to establish a session

- For weblogic.Deployer scripts containing commands requiring a user name and password, you can specify the user configuration file created via the WLST storeUserConfig command instead of entering your unencrypted credentials.

For more information about passing user credentials securely in scripts, see the following topics:

- "Starting and Stopping Servers" and "Boot Identity Files" in Oracle Fusion Middleware Managing Server Startup and Shutdown for Oracle WebLogic Server

- "Security for WLST" in Oracle Fusion Middleware Oracle WebLogic Scripting Tool

- "Configuring Remote Server Start Security for Script-based Node Manager" in Oracle Fusion Middleware Node Manager Administrator's Guide for Oracle WebLogic Server

- "Syntax for Invoking weblogic.Deployer" in Oracle Fusion Middleware Deploying Applications to Oracle WebLogic Server

On each host computer, give only one user account access to WebLogic resources (in addition to the two system administrator users who also have access privileges).

Important: WebLogic domain and server configuration files should be accessible only by the operating system users who configure or execute WebLogic Server. No other operating system user (apart from the system administrators) should have read, write, or execute access to WebLogic Server product files nor to your domain files.

On each WebLogic Server host computer, use the operating system to establish a special user account (for example, wls_owner) specifically to run WebLogic Server. Grant to this operating-system (OS) user account access privileges only to the following directories:

- Middleware Home directory
The top-level directory for all Oracle Fusion Middleware products is called the Middleware Home; this directory is created when WebLogic Server is installed. By default, this directory is named Oracle/Middleware.

- WebLogic Server product installation directory
This directory contains all the WebLogic Server software components that you choose to install on your system, including program files. By default, this directory is a subdirectory of the Middleware Home and is named Oracle/Middleware/wlserver_10.3; however, the WebLogic Server product installation directory can be located outside the Middleware Home. For more information, refer to "Selecting Directories for Installation" in Oracle WebLogic Server Installation Guide.

- WebLogic domain directories
These contain the configuration files, security files, log files, Java EE applications, and other Java EE resources for a single WebLogic domain. By default, a domain is a subdirectory of Middleware Home (for example, Oracle/Middleware/user_projects/domains/domain1); however, domain directories can be located outside the WebLogic Server installation directory and the Middleware Home as well. If you create multiple domains on a WebLogic Server host computer, each domain directory must be protected.

This protection limits the ability of other applications that are executing on the same machine as WebLogic Server to gain access to WebLogic Server files and your domain files. Without this protection, some other application could gain write access and insert malicious, executable code in JSPs and other files that provide dynamic content. The code would be executed the next time the file was served to a client.

Knowledgeable operating system users may be able to bypass WebLogic Server security if they are given write access, and in some cases read access, to the following files:

- WebLogic Server Installation

- JDK files (typically in the WebLogic Server installation, but can be configured to be separate)

- Domain directory

- JMS SAF files

- File backed HTTP sessions

Everything that uses the persistent store, such as JMS SAF files, has sensitive data that should be protected from read access as well as from write access. The persistent store supports persistence to a file-based store or to a JDBC-enabled database.

If you use the file store to store files on WebLogic Server, the applications can be stored anywhere. You must remember the locations of all of the files in order to protect them from read and write access.

If you use the JDBC store to store applications, make sure to properly secure the database by protecting it from read and write access.

For more information on using the persistent store, see "Using the WebLogic Persistent Store" in Oracle Fusion Middleware Configuring Server Environments for Oracle WebLogic Server.

Configure the Password Validation provider immediately after configuring a new WebLogic domain

The Password Validation provider, which is included with WebLogic Server, can be configured with several out-of-the-box authentication providers to manage and enforce password composition rules. Consequently, whenever a password is created or updated in the security realm, the corresponding authentication provider automatically invokes the Password Validation provider to ensure that the password meets the composition requirements that are established.

For information about how to configure and use the Password Validation provider, see "Configuring the Password Validation Provider" in Oracle Fusion Middleware Securing Oracle WebLogic Server.

To bind to protected ports on UNIX, configure WebLogic Server to switch user IDs or use Network Address Translation (NAT) software.

On UNIX systems, only processes that run under a privileged user account (in most cases, root) can bind to ports lower than 1024. UNIX systems allow only one system administrator (root) user.

However, long-running processes like WebLogic Server should not run under these privileged accounts. Instead, you can do either of the following:

- For each WebLogic Server instance that needs access to privileged ports, configure the server to start under the privileged user account, bind to privileged ports, and change its user ID to a non-privileged account.
If you use Node Manager to start the server instance, configure Node Manager to accept requests only on a secure port and only from a single, known host. Note that Node Manager needs to be started under a privileged user account.

See "Create and configure machines to run on UNIX" in the Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

- Start WebLogic Server instances from a non-privileged account and configure your firewall to use Network Address Translation (NAT) software to map protected ports to unprotected ones.

Do not run Web servers as root

When you run a Web server on Unix systems — such as Apache HTTP Server, Microsoft IIS, or Sun Java System Web Server — make sure of the following:

- The Web server should run only as an unprivileged user, never as root.

- The directory structure in which the Web server is located, including all files, should be protected from access by unprivileged users.

Taking these steps helps ensure that unprivileged users cannot insert code that can potentially be executed by the Web server.

Do not develop on a production machine.

Develop first on a development machine and then move code to the production machine when it is completed and tested. This process prevents bugs in the development environment from affecting the security of the production environment.

Do not install development or sample software on a production machine.

Do not install development tools on production machines. Keeping development tools off the production machine reduces the leverage intruders have should they get partial access to a WebLogic Server production machine.

Do not install the WebLogic Server sample applications on a production machine. When the installation program asks whether you want a Typical Installation or Custom Installation, note the following:

- If you choose Typical, the sample applications are not installed.

- If you choose Custom, the sample applications are available for installation. By default, they are not selected. However, make sure that the check mark is not entered for Server Examples.

Complete the remaining pages of the installation program.

Enable security auditing.

If the operating system on which WebLogic Server runs supports security auditing of file and directory access, Oracle recommends using audit logging to track any denied directory or file access violations. Administrators should ensure that sufficient disk space is available for the audit log.

Consider using additional software to secure your operating system.

Most operating systems can run additional software to secure a production environment. For example, an Intrusion Detection System (IDS) can detect attempts to modify the production environment.

Refer to the vendor of your operating system for information about available software.

Apply operation-system service packs and security patches.

Refer to the vendor of your operating system for a list of recommended service packs and security-related patches.

Apply the latest maintenance packs and critical patch updates.

If you are responsible for security related issues at your site, register your WebLogic Server installation with My Oracle Support. You can create a My Oracle Support account at http://www.oracle.com/support/index.html.

You should also visit the Critical Patch Updates and Security Alerts page at http://www.oracle.com/technology/deploy/security/alerts.htm.

If you have an installation of WebLogic Server 10g Release 3 (10.3) or earlier, you can obtain important security updates from the BEA Security Advisories Archive Page at http://www.oracle.com/technology/deploy/security/beaarchive.html.

In addition, you are advised to apply each maintenance pack as it is released. Maintenance packs include a roll-up of all bug fixes for each version of the product, as well as each of the previously released maintenance packs. For information about installing maintenance pack, see "Downloading and Installing Maintenance Packs" in Oracle Smart Update Installing Patches and Maintenance Packs.

To report potential security issues, you may do either of the following:

- Log in to My Oracle Support and submit a Service Request.

- Email secalert_us@oracle.com.

Do not run WebLogic Server in development mode in a production environment.

Production mode sets the server to run with settings that are more secure and appropriate for a production environment.

Note: When WebLogic Server is configured in development mode, certain error conditions, such as a misbehaving application or an invalid configuration of WebLogic Server, may result in a trace stack being displayed. While error responses generally are not dangerous, they have the potential to give attackers information about the application or the WebLogic Server installation that can be used for malicious purposes. However, when WebLogic Server is configured in production mode, stack traces are not generated; therefore, you should never run WebLogic Server in development mode in a production environment.

For information about how to change the WebLogic Server instances in a domain to run in production mode, see "Change to production mode" in the Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help. You can also enable production mode using the WebLogic Scripting Tool by setting DomainMBean.isProductionModeEnabled MBean attribute to true.

Securing Network Connections

When designing network connections, you balance the need for a security solution that is easy to manage with the need to protect strategic WebLogic resources. The following table describes options for securing your network connections.

Table 3-2 Securing Network Connections

Security Action

Description

Use hardware and software to create firewalls.

A firewall limits traffic between two networks. Firewalls can be a combination of software and hardware, including routers and dedicated gateway machines. They employ filters that allow or disallow traffic to pass based on the protocol, the service requested, routing information, packet content, and the origin and destination hosts or networks. They can also limit access to authenticated users only.

The WebLogic Security Service supports the use of third-party Identity Assertion providers, which perform perimeter-based authentication (Web server, firewall, VPN) and handle multiple security token types/protocols (SOAP, IIOP-CSIv2). For more information, refer to "Perimeter Authentication" in Oracle Fusion Middleware Understanding Security for Oracle WebLogic Server.

For more information about using firewalls with WebLogic Server, refer to "Security Options for Cluster Architectures" in Oracle Fusion Middleware Using Clusters for Oracle WebLogic Server.

Use WebLogic Server connection filters.

Instead of, or in addition to, using hardware and third-party software to create firewalls, consider using WebLogic Server connection filters to limit network traffic based on protocols, IP addresses, and DNS node names.

Connection filters are most appropriate when the machines in a WebLogic Server domain can access each other without going through a firewall. For example, you might use a firewall to limit traffic from outside the network, and then use WebLogic Server connection filters to limit traffic behind the firewall.

See "Using Connection Filters" in Oracle Fusion Middleware Securing Oracle WebLogic Server.

Use a domain-wide Administration Port for administrative traffic.

An Administration Port limits all administrative traffic between server instances in a WebLogic Server domain to a single port. When the server is run without an Administration Port, an application can inadvertently transmit confidential server configuration on the wire in clear-text. Running the server with an Administration Port significantly reduces the chances of this happening. Furthermore, having an Administrative Port configured is helpful should a Denial of Service (DoS) attack occur because the resources for handling requests for, and the limitations on Administration Port requests are separate from those of the rest of the server.

When used in conjunction with a connection filter, you can specify that a WebLogic Server instance accepts administrative requests only from a known set of machines or subnets and only on a single port.

Enabling the Administration Port requires clients to interact with the Administration Console using SSL which protects sensitive data from being sniffed on the wire by an attacker and protects against some cross site scripting attacks.

See "Configure the domain-wide administration port" and "Enable configuration auditing" in the Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

Secure the embedded LDAP port.

To protect the embedded LDAP port against brute force attacks, close off the embedded LDAP listen port using a connection filter in a single server configuration.

While this does not protect the embedded LDAP port in a multiple server configuration, the default connection filter implementation supports filtering based on the source IP address which should be used to allow access only from servers that are part of the domain. As a result, only the machines in the domain can access the LDAP port. For more information on using connection filters, see "Using Network Connection Filters" in Oracle Fusion Middleware Programming Security for Oracle WebLogic Server.

Do not enable remote access to the JVM platform MBean server.

As of JDK 1.5, the JDK provides an MBean server (the platform MBean server) and a set of MBeans that contain monitoring information about the JVM. You can configure the WebLogic Server Runtime MBean Server to run as the platform MBean server, which enables JMX clients to access the JVM MBeans and WebLogic Server MBeans from a single MBean server connection.

Remote access to the platform MBean server can be secured only by standard JDK 6 security features (see http://java.sun.com/javase/6/docs/technotes/guides/management/agent.html). If you have configured the WebLogic Server Runtime MBean Server to be the platform MBean server, enabling remote access to the platform MBean server creates an access path to WebLogic Server MBeans that is not secured through the WebLogic Server security framework.

If it is essential that remote JMX clients have access to the JVM MBeans, Oracle recommends that you access them through the WebLogic Server Runtime MBean Server. See "Registering MBeans in the JVM Platform MBean Server" in Oracle Fusion Middleware Developing Manageable Applications With JMX for Oracle WebLogic Server.

When enabling SNMP, be sure to restrict access to port numbers by using firewalls and other network security measures.

The Simple Network Management Protocol version 2 (SNMPv2), which is supported by WebLogic Server in versions 6.x through 11g Release 1 (10.3.1), lacks security. By default, SNMP is disabled in WebLogic Server. However, once you enable SNMP, the SNMPv2 protocol forces certain potential security problems to occur on the SNMP service, including unauthorized access and Denial of Service attacks.

To limit these security problems when SNMPv2 is enabled, make sure that your network is secure and that the firewall is configured to restrict access to the ports in your WebLogic Server environment.

For more information, see Oracle Fusion Middleware SNMP Management Guide for Oracle WebLogic Server.

Make sure configuration settings for complete message timeout are sized appropriately for your system.

To reduce the potential for Denial of Service (DoS) attacks, make sure that the complete message timeout parameter is configured properly for your system. This parameter sets the maximum number of seconds that a server waits for a complete message to be received.

The default value is 60 seconds, which applies to all connection protocols for the default network channel. This setting might be appropriate if the server has a number of high-latency clients. However, you should tune this to the smallest possible value without compromising system availability.

If you need a complete message timeout setting for a specific protocol, you can alternatively configure a new network channel for that protocol.

For information about displaying the Administration Console page from which the complete message timeout parameter can be set, see "Configure protocols" in the Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

On UNIX systems, set number of file descriptors appropriately for your system.

On UNIX systems, each socket connection to WebLogic Server consumes a file descriptor. To optimize availability, the number of file descriptors for WebLogic Server should be appropriate for the host machine. By default, WebLogic Server configures 1024 file descriptors. However, this setting may be low, particularly for production systems.

Note that when you tune the number of file descriptors for WebLogic Server, your changes should be in balance with any changes made to the complete message timeout parameter. A higher complete message timeout setting results in a socket not closing until the message timeout occurs, which therefore results in a longer hold on the file descriptor. So if the complete message timeout setting is high, the file descriptor limit should also be set high. This balance provides optimal system availability with reduced potential for DoS attacks.

For information about tuning the number of available file descriptors, consult your UNIX vendor's documentation.

Securing Your Database

Most Web applications use a database to store their data. Common databases used with WebLogic Server are Oracle, Microsoft SQL Server, and Informix. The databases frequently hold the Web application's sensitive data including customer lists, customer contact information, credit card information, and other proprietary data. When creating your Web application you must consider what data is going to be in the database and how secure you need to make that data. You also need to understand the security mechanisms provided by the manufacturer of the database and decide whether they are sufficient for your needs. If the mechanisms are not sufficient, you can use other security techniques to improve the security of the database, such as encrypting sensitive data before writing it to the database. For example, leave all customer data in the database in plain text except for the encrypted credit card information.

Securing the WebLogic Security Service

The WebLogic Security Service provides a powerful and flexible set of software tools for securing the subsystems and applications that run on a server instance. The following table provides a checklist of essential features that Oracle recommends you use to secure your production environment.

Table 3-3 Securing the WebLogic Security Service

Security Action

Description

Deploy production-ready security providers to the security realm.

The WebLogic Security Service uses a pluggable architecture in which you can deploy multiple security providers, each of which handles a specific aspect of security.

By default WebLogic Server includes its own security providers that provide a complete security solution. If you have purchased or written your own security providers:

- Make sure that you have deployed and configured them properly. You can verify which security providers are currently deployed in the Administration Console. In the left pane, select Console, select Security Realms, then click on the name of the realm and select the Providers tab.

- Make sure that the realm in which you deployed your security providers is the default (active) realm. For instructions on how to set the default security realm in the Administration Console, see "Change the default security realm" in the Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

- Refer to "Customizing the Default Security Configuration" in Oracle Fusion Middleware Securing Oracle WebLogic Server.

Use SSL, but do not use the demonstration digital certificates in a production environment.

To prevent sensitive data from being compromised, secure data transfers by using HTTPS.

WebLogic Server includes a set of demonstration private keys, digital certificates, and trusted certificate authorities that are for development only. Everyone who downloads WebLogic Server has the private keys for these digital certificates. Do not use the demonstration identity and trust.

Refer to "Configure keystores" in the Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help and "Configuring SSL" in Oracle Fusion Middleware Securing Oracle WebLogic Server.

Make sure that WebLogic Server enforces security constraints on digital certificates.

When communicating by SSL, by default WebLogic Server rejects any digital certificates in a certificate chain that do not have the Basic Constraint extension defined by the Certificate Authority. This level of enforcement protects your Web site from the spoofing of digital certificates.

Make sure that no server startup command includes the following option, which disables this enforcement:

-Dweblogic.security.SSL.enforceConstraints=false

For more information about this option, see "SSL Certificate Validation" in Oracle Fusion Middleware Securing Oracle WebLogic Server.

In your development environment, you might have disabled the enforcement of security constraints to work around incompatibilities with demonstration digital certificates that WebLogic Server provided in releases prior to 7.0 Service Pack 2. Make sure you enable this feature in your production environment.

Verify that host name verification is enabled to avoid man-in-the-middle attacks.

By default, the WebLogic SSL implementation validates that the host to which a connection is made is the intended or authorized party. However, during the implementation of WebLogic Server at your site, you might have disabled host name verification.

To enable host name verification, see "Configure a custom host name verifier" in the Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

Refer to "Using Host Name Verification" in Oracle Fusion Middleware Securing Oracle WebLogic Server.

Background Information: A man-in-the-middle attack occurs when a machine inserted into the network captures, modifies, and retransmits messages to the unsuspecting parties. One way to avoid man-in-the-middle attacks is to validate that the host to which a connection is made is the intended or authorized party. An SSL client can compare the host name of the SSL server with the digital certificate of the SSL server to validate the connection. The WebLogic Server HostName Verifier protects SSL connections from man-in-the-middle attacks.

Restrict the size and the time limit of requests on external channels to prevent Denial of Service attacks.

To prevent some Denial of Service (DoS) attacks, WebLogic Server can restrict the size of a message as well as the maximum time it takes a message to arrive. The default setting for message size is 10 megabytes and 480 seconds for the complete message timeout. Oracle recommends that you:

- Set the size limit of requests on internal channels so that a Managed Server can to accept messages from the Administration Server.

- Restrict the size and time limits of requests on external channels.

- Configure internal channels so that they are only accessible internally and not externally.

To configure these settings for the HTTP, T3, and IIOP protocols refer to the following tasks in the Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help:

- "Configure HTTP protocol"

- "Configure T3 Protocol"

- "Enable and configure IIOP"

See also "Reducing the Potential for Denial of Service Attacks" in Oracle Fusion Middleware Performance and Tuning for Oracle WebLogic Server.

Background Information: A DoS attack leaves a Web site running but unusable. Hackers deplete or delete one or more critical resources of the Web site.

To perpetrate a DoS attack on a WebLogic Server instance, an intruder bombards the server with many requests that are very large, are slow to complete, or never complete so that the client stops sending data before completing the request.

Set the number of sockets allowed to a server to prevent DoS attacks.

To prevent some DoS attacks, limit the number of sockets allowed for a server so that there are fewer than the number of sockets allowed to the entire process. This ensures that the number of file descriptors allowed by the operating system limits is not exceeded.

Even after the server's limit is exceeded, administrators can access the server through the Administration Port.

You can configure this setting using the MaxOpenSockCount flag.

In the Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help, see "Servers: Configuration: Tuning".

Configure WebLogic Server to avoid overload conditions.

Configure WebLogic Server to avoid overload conditions in order to allow WebLogic Server sufficient processing power so that an administrator can connect to it and attempt to correct the problem in case the server comes under heavy load.

Because communication over administration channels is not prevented when the system is overloaded, administrators can always connect regardless of any current overload condition.

In case of heavy load, the administrator should bring the server into the admin state, locate the offending user, and then prevent that user from overloading the server with requests.

To configure WebLogic Server to avoid overload conditions, set the shared capacity attribute in the overload protection MBean. The setting you choose for this attribute is the threshold after which no more non-administrator requests are accepted by WebLogic Server.

For more information on overload conditions, see "Avoiding and Managing Overload" in Oracle Fusion Middleware Configuring Server Environments for Oracle WebLogic Server.

Configure user lockouts and login time limits to prevent attacks on user accounts.

By default, the WebLogic Security Service provides security against dictionary and brute force attacks of user accounts. If during development you changed the settings for the number of invalid login attempts required before locking the account, the time period in which invalid login attempts have to take place before locking the account, or the amount of time the user account is locked, review the settings and verify that they are adequate for your production environment.

Note: User lockout is effected by the WebLogic Security Service on a per-server basis. For example, a user who has been locked out of an application hosted on a given Managed Server (or cluster) is not necessarily locked out of the Administration Console. Likewise, a user who has been locked out of the Administration Console is not necessarily prevented from attempting to log in to an application hosted on a Managed Server.

See "Protect user accounts" in the Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

Background Information: In a dictionary/brute force attack, a hacker sets up a script to attempt logins using passwords out of a "dictionary." The WebLogic Server user lockout and login settings can protect user accounts from dictionary/brute force attacks.

If you use multiple Authentication providers, be sure to set the JAAS control flag correctly.

If a security realm has multiple Authentication providers configured, configure the order and precedence of each provider by setting the JAAS control flags.

See "Set the JAAS control flag" in the Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

Enable security auditing.

Auditing is the process of recording key security events in your WebLogic Server environment. When the Auditing provider that the WebLogic Security Service provides is enabled, it logs events in DomainName\DefaultAuditRecorder.log.

You enable an Auditing provider in the Administration Console on the Security Realms > RealmName > Providers > Auditing page.

See "Configure Auditing providers" in the Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

Note: Using an Auditing provider might adversely affect the performance of WebLogic Server even if only a few events are logged.

Review the auditing records periodically to detect security breaches and attempted breaches. Noting repeated failed logon attempts or a surprising pattern of security events can prevent serious problems.

If you develop your own custom Auditing provider and would like more information on posting audit events from a provider's Mbean, refer to "Best Practice: Posting Audit Events from a Provider's MBean" in Oracle Fusion Middleware Developing Security Providers for Oracle WebLogic Server.

Ensure that you have correctly assigned users and groups to the default WebLogic Server security roles.

By default, all WebLogic resources are protected by security policies that are based on a default set of security roles.

Make sure you have assigned the desired set of users and groups to these default security roles.

Refer to "Users, Groups, And Security Roles" in Oracle Fusion Middleware Securing Resources Using Roles and Policies for Oracle WebLogic Server.

Create no fewer than two user accounts with system administrator privileges.

One of the system administrator users should be created when the domain is created. Create other user(s) and assign them the Admin security role. When creating system administrator users give them unique names that cannot be easily guessed.

Having at least two system administrator user accounts helps to ensure that one user maintains account access in case another user becomes locked out by a dictionary/brute force attack.

Securing Applications

Although much of the responsibility for securing the WebLogic resources in a WebLogic Server domain fall within the scope of the server, some security responsibilities lie within the scope of individual applications. For some security options, the WebLogic Security Service enables you to determine whether the server or individual applications are responsible. For each application that you deploy in a production environment, review the items in the following table to verify that you have secured its resources.

Note:
The HTTP Publish-Subscribe server included in WebLogic Server has specific lockdown steps, which are described in "Using the HTTP Publish-Subscribe Server" in Oracle Fusion Middleware Developing Web Applications, Servlets, and JSPs for Oracle WebLogic Server.

Table 3-4 Securing Applications

Security Action

Description

Determine which deployment model secures your Web applications and EJBs.

By default, each Web application and EJB uses deployment descriptors (XML files) to declare its secured resources and the security roles that can access the secured resources.

Instead of declaring security in Web application and EJB deployment descriptors, you can use the Administration Console to set security policies that secure access to Web applications and EJBs. This technique provides a single, centralized location from which to manage security for all Web applications and EJBs.

You can combine these two techniques and configure WebLogic Server to copy security configurations from existing deployment descriptors upon the initial deployment of a URL (Web) or EJB resource. Once these security configurations are copied, the Administration Console can be used for subsequent updates.

Refer to "Options for Securing Web Application and EJB Resources" in Oracle Fusion Middleware Securing Resources Using Roles and Policies for Oracle WebLogic Server.

Set the FrontendHost attribute on the WebServerMBean or ClusterMBean to prevent redirection attacks

When a request on a web application is redirected to another location, the Host header contained in the request is used by default in the Location header of the response. Because the Host header can be spoofed — that is, corrupted to contain a different host name and other parameters — this behavior can be exploited to launch a redirection attack on a third party.

To prevent the likelihood of this occurrence, set the FrontendHost attribute on either the WebserverMBean or ClusterMBean to specify the host to which all redirected URLs are sent. The host specified in the FrontendHost attribute will be used in the Location header of the response instead of the one contained in the original request.

For more information, see "FrontendHost" in Oracle Fusion Middleware Oracle WebLogic Server MBean Reference.

Use JSP comment tags instead of HTML comment tags.

Comments in JSP files that might contain sensitive data and or other comments that are not intended for the end user should use the JSP syntax of <%/* xxx */%> instead of the HTML syntax <!-- xxx -->. The JSP comments, unlike the HTML comments, are deleted when the JSP is compiled and therefore cannot be viewed in the browser.

Do not install uncompiled JSPs and other source code on the production machine.

Always keep source code off of the production machine. Getting access to your source code allows an intruder to find security holes.

Consider precompiling JSPs and installing only the compiled JSPs on the production machine. For information about precompiling JSPs, refer to "Precompiling JSPs" in Oracle Fusion Middleware Developing Web Applications, Servlets, and JSPs for Oracle WebLogic Server.

Configure your applications to use SSL.

Set the transport-guarantee to CONFIDENTIAL in the user-data-constraint element of the web.xml file whenever appropriate.

Refer to "security-constraint" in Developing Web Applications, Servlets, and JSPs in WebLogic Server.

Do not use the Servlet servlet.

Oracle does not recommend using the Servlet servlet in a production environment.

Instead, map servlets to URIs explicitly. Remove all existing mappings between WebLogic servlets and the Servlet servlet from all Web applications before using the applications in a production environment.

For information on mapping servlets, refer to "Configuring Servlets" in Oracle Fusion Middleware Developing Web Applications, Servlets, and JSPs for Oracle WebLogic Server.

Do not leave FileServlet as the default servlet in a production environment.

Oracle does not recommend using the FileServlet servlet as the default servlet a production environment.

For information on setting up a default servlet, refer to "Setting Up a Default Servlet" in Oracle Fusion Middleware Developing Web Applications, Servlets, and JSPs for Oracle WebLogic Server.

Verify all WebLogic security policies.

In WebLogic Server 7.0, security policies replace ACLs and answer the question "who has access" to a WebLogic resource.

Make sure that you have not removed security policies from WebLogic resources, and make sure that your security role assignments provide users the kind of access that you intend.

Refer to Oracle Fusion Middleware Securing Resources Using Roles and Policies for Oracle WebLogic Server.

Examine applications for security.

There are instances where an application can lead to a security vulnerability. Many of these instances are defined by third-party organizations such as Open Web Application Security Project (see http://www.owasp.org/documentation/topten for a list of common problems).

Of particular concern is code that uses Java native interface (JNI) because Java positions native code outside of the scope of Java security. If Java native code behaves errantly, it is only constrained by the operating system. That is, the Java native code can do anything WebLogic Server itself can do. This potential vulnerability is further complicated by the fact that buffer overflow errors are common in native code and can be used to run arbitrary code.

If your applications contain untrusted code, enable the Java security manager.

The Java security manager defines and enforces permissions for classes that run within a JVM. In many cases, where the threat model does not include malicious code being run in the JVM, the Java security manager is unnecessary. However, when third parties use WebLogic Server and untrusted classes are being run, the Java security manager may be useful.

To enable the Java security manager for a server instance, use the following Java options when starting the server:

-Djava.security.manager
-Djava.security.policy[=]=filename

Refer to "Using the Java Security Manager to Protect WebLogic Resources" in Oracle Fusion Middleware Programming Security for Oracle WebLogic Server.

Replace HTML special characters when servlets or JSPs return user-supplied data.

The ability to return user-supplied data can present a security vulnerability called cross-site scripting, which can be exploited to steal a user's security authorization. For a detailed description of cross-site scripting, refer to "Understanding Malicious Content Mitigation for Web Developers" (a CERT security advisory) at http://www.cert.org/tech_tips/malicious_code_mitigation.html.

To remove the security vulnerability, before you return data that a user has supplied, scan the data for HTML special characters. If you find any such characters, replace them with their HTML entity or character reference. Replacing the characters prevents the browser from executing the user-supplied data as HTML.

See "Securing User-Supplied Data in JSPs" and "Securing Client Input" in Oracle Fusion Middleware Developing Web Applications, Servlets, and JSPs for Oracle WebLogic Server.

Ensure security checks on performed on JMS resources.

Set the weblogic.jms.securityCheckInterval attribute to zero to ensure that an authorization check is performed for every Send, Receive, and getEnumeration action on a JMS resource.

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2014, Oracle and/or its affiliates. All rights reserved.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

Alpha and Beta Draft Documentation Notice

If this document is in preproduction status:

This documentation is in preproduction status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.