IBM WebSphere V5.0 Security - CGISecurity

10.Ensure the Client Authentication is enabled. This is optional and is enabled in
this example.
11.Ensure the Security Level is set to High.
12.Ensure that the Cryptographic Token box is not selected.
13.It is not necessary to provide any custom properties. Click OK.
14.Save the changes to the master configuration by selecting the link at the top
of the window.
The password is stored in a file called security.xml in
/config/cells/ and is protected with an Base64
ASCII encoding.
Example 10-4 Excerpt from security.xml
Note: Although the password appears as a series of asterisks in the Admin
console, it will be stored in an easily readable string in the repository. It is a
simple task for an eavesdropper to decode this string and recover the
password and so it is important to protect the respository from unauthorized
users.
The appropriate WebSphere components may now be set to use the
newly-defined SSL configuration. It might also be necesary to configure some
non-WebSphere components, such as a Web server, in order to ensure a secure
connection between all components. Typically, a digital certificate will be created
for each component. In a Web server scenario, for instance, the WebSphere
server will own a certificate and the Web server will own another. The certificates
will identify the particular component by which they are owned.
Chapter 10. Administering WebSphere security 277