Siteminder Adminui Keystore Password Exposure
search cancel

Siteminder Adminui Keystore Password Exposure

book

Article ID: 138655

calendar_today

Updated On:

Products

CA Single Sign On Secure Proxy Server (SiteMinder) CA Single Sign On Agents (SiteMinder) CA Single Sign On Federation (SiteMinder) CA Single Sign On SOA Security Manager (SiteMinder) SITEMINDER

Issue/Introduction

In Security auditing , there may be flag that the adminui process may expose keystore password information.

 

/opt/CA/siteminder/adminu/runtime/bin/java -D[Standalone] -server -Xms1024m -Xmx1536m -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true -Dcom.sun.jersey.server.impl.cdi.lookupExtensionInBeanManager=true -Djavax.net.ssl.keyStore=/opt/CA/siteminder/adminui/standalone/configuration/security/key.jks -Djavax.net.ssl.keyStoreType=jks -Djavax.net.ssl.keyStorePassword=smadminui -Djavax.net.ssl.trustStore=/opt/CA/siteminder/adminui/standalone/configuration/security/trust.jks -Djavax.net.ssl.trustStoreType=jks -Djavax.net.ssl.trustStorePassword=smadminui -Dorg.jboss.boot.log.file=/opt/CA/siteminder/adminui/standalone/log/server.log -Dlogging.configuration=file:/opt/CA/siteminder/adminui/standalone/configuration/logging.properties -jar /opt/CA/siteminder/adminui/jboss-modules.jar -mp /opt/CA/siteminder/adminui/modules org.jboss.as.standalone -Djboss.home.dir=/opt/CA/siteminder/adminui -Djboss.server.base.dir=/opt/CA/siteminder/adminui/standalone -c standalone-full.xml




Environment

PRODUCT: Siteminder

COMPONENT : SITEMINDER -POLICY SERVER

VERSION : 12.8.x

OS: ANY

Cause

This data is exposed in the 'standalone-full.xml' file by default.

Resolution

1) Back-up the Siteminder AdminUI "standalone.conf" file

WINDOWS:

Default: <SMAdminUI_Install_Dir>CA\siteminder\adminui\bin\standalone.conf

UNIX:

<SMAdminUI_Install_Dir>/CA/siteminder/adminui/bin/standalone.conf

2) Comment out the following entries in the Siteminder AdminUI "standalone.conf" file

JAVA_OPTS="$JAVA_OPTS -Djavax.net.ssl.keyStorePassword=changeit"
JAVA_OPTS="$JAVA_OPTS -Djavax.net.ssl.trustStorePassword=changeit"

When running [ps -ef|grep java] it should no longer return the passwords for the key store and trust store.