'TCAT-AS-000710 - Keystore file must be protected.' (Vuln ID: V-222967)

Products

• CA Spectrum
• DX NetOps

Issue/Introduction

keystore/cacerts permissions

Run the following commands on the Tomcat server:

sudo chmod 640 [keystorefile]
sudo chown root [keystorefile]
sudo chgrp tomcat [keystorefile]

Store the keystore file in a secured folder within the Tomcat folder path.

Keystore file contains authentication information used to access application data and data resources. Access to the file must be protected.

The default location is in the .keystore file stored in the home folder of the user account used to run Tomcat although some administrators may choose to locate the file elsewhere. The location will also be specified in the server.xml file.

Environment

Release : 21.2

Component : Spectrum OneClick

Resolution

DX Netops Spectrum stores this under $SPECROOT/custom area.

Therefore it is already in a secure location.

Location can be altered/specified in the server.xml file.

Permissions can be set as required, as long as they are set to that the user running Spectrum can read/see the cert and its location.