How Passwords Are Protected in WebLogic Server Protecting User Accounts

Configuring Security for a WebLogic Domain 13-7

13.5 Viewing MBean Attributes

The Anonymous Admin Lookup Enabled option specifies whether anonymous, read-only access to WebLogic Server MBeans should be allowed from the MBean API. With this anonymous access, you can see the value of any MBean attribute that is not explicitly marked as protected by the WebLogic Server MBean authorization process. This option is enabled by default to assure backward compatibility. For greater security, you should disable this anonymous access. To verify the setting of the Anonymous Admin Lookup Enabled option in the WebLogic Server Administration Console, select Domain Security General, or view the SecurityConfigurationMBean.AnonymousAdminLookupEnabled attribute.

13.6 How Passwords Are Protected in WebLogic Server

It is important to protect passwords that are used to access resources in a WebLogic domain. In the past, usernames and passwords were stored in clear text in a WebLogic security realm. Now all the passwords in a WebLogic domain are hashed. The SerializedSystemIni.dat file contains the hashes for the passwords. It is associated with a specific WebLogic domain so it cannot be moved from domain to domain. If the SerializedSystemIni.dat file is destroyed or corrupted, you must reconfigure the WebLogic domain. Therefore, you should take the following precautions: ■ Make a backup copy of the SerializedSystemIni.dat file and put it in a safe location. ■ Set permissions on the SerializedSystemIni.dat file such that the system administrator of a WebLogic Server deployment has write and read privileges and no other users have any privileges.

13.7 Protecting User Accounts

WebLogic Server defines a set of configuration options to protect user accounts from intruders. In the default security configuration, these options are set for maximum protection. You can use the Administration Console to modify these options on the Configuration User Lockout page. As a system administrator, you have the option of turning off all the configuration options, increasing the number of login attempts before a user account is locked, increasing the time period in which invalid login attempts are made before locking the user account, and changing the amount of time a user account is locked. Remember that changing the configuration options lessens security and leaves user accounts vulnerable to security attacks. See Set user lockout attributes in the Oracle WebLogic Server Administration Console Help. 13-8 Securing Oracle WebLogic Server For information about unlocking a locked user account, see Unlock user accounts in the Oracle WebLogic Server Administration Console Help. Unlocking a locked user account can be done through either the WebLogic Administration Console or the clearLockout attribute on the UserLockoutManagerRuntimeMBean.

13.8 Configuring a Domain to Use JAAS Authorization