Apache Server 2.4 UNIX Server Security Technical Implementation Guide
Pick two releases to diff their requirements.
Open a previous version of this STIG.
Digest of Updates +48 −48
Comparison against the immediately-prior release (V1R4). Rule matching uses the Group Vuln ID. Content-change detection compares the rule’s description, check, and fix text after stripping inline markup — cosmetic-only edits aren’t flagged.
Added rules 48
- V-214228 Medium The Apache web server must limit the number of allowed simultaneous session requests.
- V-214229 Medium The Apache web server must perform server-side session management.
- V-214230 Medium The Apache web server must use cryptography to protect the integrity of remote sessions.
- V-214231 Medium The Apache web server must have system logging enabled.
- V-214232 Medium The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
- V-214233 Medium An Apache web server, behind a load balancer or proxy server, must produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
- V-214234 Medium The Apache web server must use a logging mechanism that is configured to alert the Information System Security Officer (ISSO) and System Administrator (SA) in the event of a processing failure.
- V-214235 Medium The Apache web server log files must only be accessible by privileged users.
- V-214236 Medium The log information from the Apache web server must be protected from unauthorized modification or deletion.
- V-214237 Medium The log data and records from the Apache web server must be backed up onto a different system or media.
- V-214238 Medium Expansion modules must be fully reviewed, tested, and signed before they can exist on a production Apache web server.
- V-214239 Medium The Apache web server must not perform user management for hosted applications.
- V-214240 Medium The Apache web server must only contain services and functions necessary for operation.
- V-214241 Medium The Apache web server must not be a proxy server.
- V-214242 High The Apache web server must provide install options to exclude the installation of documentation, sample code, example applications, and tutorials.
- V-214243 Medium The Apache web server must have resource mappings set to disable the serving of certain file types.
- V-214244 Medium The Apache web server must allow the mappings to unused and vulnerable scripts to be removed.
- V-214245 Medium The Apache web server must have Web Distributed Authoring (WebDAV) disabled.
- V-214246 Medium The Apache web server must be configured to use a specified IP address and port.
- V-214247 Medium Apache web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.
- V-214248 High Apache web server application directories, libraries, and configuration files must only be accessible to privileged users.
- V-214249 Medium The Apache web server must separate the hosted applications from hosted Apache web server management functionality.
- V-214250 Medium The Apache web server must invalidate session identifiers upon hosted application user logout or other session termination.
- V-214251 Medium Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application.
- V-214252 Medium The Apache web server must generate a session ID long enough that it cannot be guessed through brute force.
- V-214253 High The Apache web server must generate a session ID using as much of the character set as possible to reduce the risk of brute force.
- V-214254 Medium The Apache web server must be built to fail to a known safe state if system initialization fails, shutdown fails, or aborts fail.
- V-214255 Medium The Apache web server must be tuned to handle the operational requirements of the hosted application.
- V-214256 Medium Warning and error messages displayed to clients must be modified to minimize the identity of the Apache web server, patches, loaded modules, and directory paths.
- V-214257 Medium Debugging and trace information used to diagnose the Apache web server must be disabled.
- V-214258 Medium The Apache web server must set an inactive timeout for sessions.
- V-214259 Medium The Apache web server must restrict inbound connections from nonsecure zones.
- V-214260 Medium The Apache web server must be configured to immediately disconnect or disable remote access to the hosted applications.
- V-214261 Medium Non-privileged accounts on the hosting system must only access Apache web server security-relevant information and functions through a distinct administrative account.
- V-214262 Medium The Apache web server must use a logging mechanism that is configured to allocate log record storage capacity large enough to accommodate the logging requirements of the Apache web server.
- V-214263 Medium The Apache web server must not impede the ability to write specified log record content to an audit log server.
- V-214264 Medium The Apache web server must be configured to integrate with an organizations security infrastructure.
- V-214265 Medium The Apache web server must generate log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) which are stamped at a minimum granularity of one second.
- V-214266 Medium The Apache web server must prohibit or restrict the use of nonsecure or unnecessary ports, protocols, modules, and/or services.
- V-214267 Medium The Apache web server must be protected from being stopped by a non-privileged user.
- V-214268 Medium Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data.
- V-214269 Medium The Apache web server must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
- V-214270 Medium The Apache web server must install security-relevant software updates within the configured time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).
- V-214271 High The account used to run the Apache web server must not have a valid login shell and password defined.
- V-214272 Low The Apache web server must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.
- V-214273 High The Apache web server software must be a vendor-supported version.
- V-214274 Medium The Apache web server htpasswd files (if present) must reflect proper ownership and permissions.
- V-214275 Medium HTTP request methods must be limited.
Removed rules 48
- V-92597 Medium The Apache web server must limit the number of allowed simultaneous session requests.
- V-92599 Medium The Apache web server must perform server-side session management.
- V-92601 Medium The Apache web server must use cryptography to protect the integrity of remote sessions.
- V-92607 Medium The Apache web server must have system logging enabled.
- V-92609 Medium The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
- V-92621 Medium An Apache web server, behind a load balancer or proxy server, must produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
- V-92627 Medium The Apache web server must use a logging mechanism that is configured to alert the Information System Security Officer (ISSO) and System Administrator (SA) in the event of a processing failure.
- V-92629 Medium The Apache web server log files must only be accessible by privileged users.
- V-92631 Medium The log information from the Apache web server must be protected from unauthorized modification or deletion.
- V-92635 Medium The log data and records from the Apache web server must be backed up onto a different system or media.
- V-92637 Medium Expansion modules must be fully reviewed, tested, and signed before they can exist on a production Apache web server.
- V-92639 Medium The Apache web server must not perform user management for hosted applications.
- V-92641 Medium The Apache web server must only contain services and functions necessary for operation.
- V-92643 Medium The Apache web server must not be a proxy server.
- V-92645 High The Apache web server must provide install options to exclude the installation of documentation, sample code, example applications, and tutorials.
- V-92653 Medium The Apache web server must have resource mappings set to disable the serving of certain file types.
- V-92655 Medium The Apache web server must allow the mappings to unused and vulnerable scripts to be removed.
- V-92659 Medium The Apache web server must have Web Distributed Authoring (WebDAV) disabled.
- V-92661 Medium The Apache web server must be configured to use a specified IP address and port.
- V-92671 Medium Apache web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.
- V-92673 High Apache web server application directories, libraries, and configuration files must only be accessible to privileged users.
- V-92675 Medium The Apache web server must separate the hosted applications from hosted Apache web server management functionality.
- V-92677 Medium The Apache web server must invalidate session identifiers upon hosted application user logout or other session termination.
- V-92679 Medium Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application.
- V-92687 Medium The Apache web server must generate a session ID long enough that it cannot be guessed through brute force.
- V-92689 High The Apache web server must generate a session ID using as much of the character set as possible to reduce the risk of brute force.
- V-92695 Medium The Apache web server must be built to fail to a known safe state if system initialization fails, shutdown fails, or aborts fail.
- V-92697 Medium The Apache web server must be tuned to handle the operational requirements of the hosted application.
- V-92699 Medium Warning and error messages displayed to clients must be modified to minimize the identity of the Apache web server, patches, loaded modules, and directory paths.
- V-92701 Medium Debugging and trace information used to diagnose the Apache web server must be disabled.
- V-92705 Medium The Apache web server must set an inactive timeout for sessions.
- V-92709 Medium The Apache web server must restrict inbound connections from nonsecure zones.
- V-92711 Medium The Apache web server must be configured to immediately disconnect or disable remote access to the hosted applications.
- V-92713 Medium Non-privileged accounts on the hosting system must only access Apache web server security-relevant information and functions through a distinct administrative account.
- V-92715 Medium The Apache web server must use a logging mechanism that is configured to allocate log record storage capacity large enough to accommodate the logging requirements of the Apache web server.
- V-92717 Medium The Apache web server must not impede the ability to write specified log record content to an audit log server.
- V-92719 Medium The Apache web server must be configured to integrate with an organizations security infrastructure.
- V-92723 Medium The Apache web server must generate log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) which are stamped at a minimum granularity of one second.
- V-92727 Medium The Apache web server must prohibit or restrict the use of nonsecure or unnecessary ports, protocols, modules, and/or services.
- V-92731 Medium The Apache web server must be protected from being stopped by a non-privileged user.
- V-92741 Medium Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data.
- V-92745 Medium The Apache web server must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
- V-92749 Medium The Apache web server must install security-relevant software updates within the configured time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).
- V-92751 High The account used to run the Apache web server must not have a valid login shell and password defined.
- V-92753 Low The Apache web server must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.
- V-92755 High The Apache web server software must be a vendor-supported version.
- V-92757 Medium The Apache web server htpasswd files (if present) must reflect proper ownership and permissions.
- V-92759 Medium HTTP request methods must be limited.
- RMF Control
- AC-10
- Severity
- M
- CCI
- CCI-000054
- Version
- AS24-U1-000010
- Vuln IDs
-
- V-214228
- V-92597
- Rule IDs
-
- SV-214228r505935_rule
- SV-102685
Checks: C-15442r276944_chk
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Search for the directives "KeepAlive" and "MaxKeepAliveRequests" in the "httpd.conf" file: # cat /<path_to_file>/httpd.conf | grep -i "keepalive" KeepAlive On MaxKeepAliveRequests 100 If the value of "KeepAlive" is set to "off" or does not exist, this is a finding. If the value of "MaxKeepAliveRequests" is set to a value less than "100" or does not exist, this is a finding.
Fix: F-15440r276945_fix
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Set the "KeepAlive" directive to a value of "on"; add the directive if it does not exist. Set the "MaxKeepAliveRequests" directive to a value of "100" or greater; add the directive if it does not exist. Restart Apache: apachectl restart
- RMF Control
- AC-10
- Severity
- M
- CCI
- CCI-000054
- Version
- AS24-U1-000020
- Vuln IDs
-
- V-214229
- V-92599
- Rule IDs
-
- SV-214229r505935_rule
- SV-102687
Checks: C-15443r276947_chk
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Search for the "session_module" and "usertrack_module" directives: # cat /<path_to_file>/httpd.conf | grep -i "session_module" # cat /<path_to_file>/httpd.conf | grep -i "usertrack_module" If "session_module" and "usertrack_module" are not enabled or do not exist, this is a finding. Alternatively, issue the following command: httpd -M |grep -E 'session_module|usertrack' If results do not return both usertrack_module (shared) and session_module (shared), this is a finding.
Fix: F-15441r276948_fix
If the modules are not installed, install any missing packages. Add the following lines to the "httpd.conf" file: LoadModule usertrack_module modules/mod_usertrack.so LoadModule session_module modules/mod_session.so Additional documentation can be found at: https://httpd.apache.org/docs/2.4/mod/mod_usertrack.html https://httpd.apache.org/docs/2.4/mod/mod_session.html Restart Apache: apachectl restart
- RMF Control
- AC-17
- Severity
- M
- CCI
- CCI-000068
- Version
- AS24-U1-000030
- Vuln IDs
-
- V-214230
- V-92601
- Rule IDs
-
- SV-214230r505935_rule
- SV-102689
Checks: C-15444r276950_chk
In a command line, run "httpd -M | grep -i ssl_module". If the "ssl_module" is not found, this is a finding. Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Search for the "SSLCACertificateFile" directive: # cat /<path_to_file>/httpd.conf | grep -i "SSLCACertificateFile" Review the path of the "SSLCACertificateFile" directive. Review the contents of <'path of SSLCACertificateFile'>\ca-bundle.crt. Examine the contents of this file to determine if the trusted CAs are DoD approved. If the trusted CA that is used to authenticate users to the website does not lead to an approved DoD CA, this is a finding. NOTE: There are non-DoD roots that must be on the server for it to function. Some applications, such as antivirus programs, require root CAs to function. DoD-approved certificate can include the External Certificate Authorities (ECA) if approved by the AO. The PKE InstallRoot 3.06 System Administrator Guide (SAG), dated 08 Jul 2008, contains a complete list of DoD, ECA, and IECA CAs.
Fix: F-15442r276951_fix
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Ensure the "SSLProtocol" is added and looks like the following: SSLProtocol -ALL +TLSv1.2 Restart Apache: apachectl restart
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- AS24-U1-000065
- Vuln IDs
-
- V-214231
- V-92607
- Rule IDs
-
- SV-214231r505935_rule
- SV-102695
Checks: C-15445r276953_chk
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Search for the directive "CustomLog" in the "httpd.conf" file: # cat /<path_to_file>/httpd.conf | grep -i "CustomLog" If the "CustomLog" directive is missing, this is a finding: An example CustomLog directive would be as follows: CustomLog "logs/access_log" common or CustomLog “log/access_log” combined (May also be "Logs/access_log")
Fix: F-15443r276954_fix
Edit the "httpd.conf" file and enter the name, path and level for the CustomLog.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- AS24-U1-000070
- Vuln IDs
-
- V-214232
- V-92609
- Rule IDs
-
- SV-214232r505935_rule
- SV-102697
Checks: C-15446r276956_chk
In a command line, run "httpd -M | grep -i log_config_module". If the "log_config_module" is not enabled, this is a finding. Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Search for the directive "LogFormat" in the "httpd.conf" file: # cat /<path_to_file>/httpd.conf | grep -i "LogFormat" If the "LogFormat" directive is missing, this is a finding: An example is: LogFormat "%a %A %h %H %l %m %s %t %u %U \"%{Referer}i\" " common
Fix: F-15444r276957_fix
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Uncomment the "log_config_module" module line. Configure the "LogFormat" in the "httpd.conf" file to look like the following: LogFormat "%a %A %h %H %l %m %s %t %u %U \"%{Referer}i\" " common Restart Apache: apachectl restart NOTE: Your log format may be using different variables based on your environment, however it should be verified to be producing the same end result of logged elements.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000133
- Version
- AS24-U1-000130
- Vuln IDs
-
- V-214233
- V-92621
- Rule IDs
-
- SV-214233r505935_rule
- SV-102709
Checks: C-15447r505079_chk
If Apache server is not behind a load balancer or proxy server, this check is Not Applicable. Interview the System Administrator to review the configuration of the Apache web server architecture and determine if inbound web traffic is passed through a proxy. If the Apache web server is receiving inbound web traffic through a proxy, the audit logs must be reviewed to determine if correct source information is being passed through by the proxy server. Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Review the location of the log files. When the log file is displayed, review the source IP information in the log entries and verify the entries do not reflect the IP address of the proxy server. If the log entries in the log file(s) reflect the IP address of the client in addition to the proxy address, this is not a finding. If the log entries in the log file(s) reflect the IP address of the proxy server as the source, this is a finding. If logs containing source/destination IPs can be obtained at the load balancer/proxy server, this is not a finding.
Fix: F-15445r505080_fix
Access the proxy server through which inbound web traffic is passed and configure settings to pass web traffic to the Apache web server transparently. Refer to https://httpd.apache.org/docs/2.4/mod/mod_remoteip.html for additional information on logging options based on your proxy/load balancing setup.
- RMF Control
- AU-5
- Severity
- M
- CCI
- CCI-000139
- Version
- AS24-U1-000160
- Vuln IDs
-
- V-214234
- V-92627
- Rule IDs
-
- SV-214234r505935_rule
- SV-102715
Checks: C-15448r276962_chk
Work with the SIEM administrator to determine if an alert is configured when audit data is no longer received as expected. If there is no alert configured, this is a finding.
Fix: F-15446r276963_fix
Work with the SIEM administrator to configure an alert when no audit data is received from Apache based on the defined schedule of connections.
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-000162
- Version
- AS24-U1-000180
- Vuln IDs
-
- V-214235
- V-92629
- Rule IDs
-
- SV-214235r505935_rule
- SV-102717
Checks: C-15449r276965_chk
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Review the log file location. To determine permissions for log files, from the command line, navigate to the directory where the log files are located and enter the following command: ls -alH <HTTPD_ROOT>/log* Note the owner and group permissions on these files. Only system administrators and service accounts running the server should have permissions to the files. If any users other than those authorized have read access to the log files, this is a finding.
Fix: F-15447r276966_fix
To protect the integrity of the data that is being captured in the log files, ensure that only the members of the Auditors group, Administrators, and the user assigned to run the web server software is granted permissions to read the log files.
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-000163
- Version
- AS24-U1-000190
- Vuln IDs
-
- V-214236
- V-92631
- Rule IDs
-
- SV-214236r505935_rule
- SV-102719
Checks: C-15450r276968_chk
Verify the log information from the web server must be protected from unauthorized modification. Review the web server documentation and deployed configuration settings to determine if the web server logging features protect log information from unauthorized modification. Review file system settings to verify the log files have secure file permissions. Run the following command: ls -l <'INSTALL PATH'>/logs If the web server log files present are owned by anyone other than an administrative service account this is a finding.
Fix: F-15448r276969_fix
Determine the location of the "ErrorLog" directory in the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Open the "httpd.conf" file. Look for the "ErrorLog" directive. Ensure the permissions and ownership of all files in the Apache log directory are correct by executing the following commands as an administrative service account: # chown <'service account'> <'ErrorLog directive PATH'>/*
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-001348
- Version
- AS24-U1-000210
- Vuln IDs
-
- V-214237
- V-92635
- Rule IDs
-
- SV-214237r505935_rule
- SV-102723
Checks: C-15451r276971_chk
Interview the Information System Security Officer, System Administrator, Web Manager, Webmaster, or developers as necessary to determine whether a tested and verifiable backup strategy has been implemented for web server software and all web server data files. Proposed questions: - Who maintains the backup and recovery procedures? - Do you have a copy of the backup and recovery procedures? - Where is the off-site backup location? - Is the contingency plan documented? - When was the last time the contingency plan was tested? - Are the test dates and results documented? If there is not a backup and recovery process for the web server, this is a finding.
Fix: F-15449r276972_fix
Document the web server backup procedures.
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001749
- Version
- AS24-U1-000230
- Vuln IDs
-
- V-214238
- V-92637
- Rule IDs
-
- SV-214238r505935_rule
- SV-102725
Checks: C-15452r276974_chk
Enter the following command: "httpd -M" This will provide a list of the loaded modules. Validate that all displayed modules are required for operations. If any module is not required for operation, this is a finding. NOTE: The following modules are needed for basic web function and do not need to be reviewed: core_module http_module so_module mpm_prefork_module For a complete list of signed Apache Modules, review https://httpd.apache.org/docs/2.4/mod/.
Fix: F-15450r276975_fix
Remove any unsigned modules.
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- AS24-U1-000240
- Vuln IDs
-
- V-214239
- V-92639
- Rule IDs
-
- SV-214239r505935_rule
- SV-102727
Checks: C-15453r276977_chk
Review the web server documentation and configuration to determine if the web server is being used as a user management application. Search for "AuthUserFile" in the configuration files in the installed Apache Path. Example: grep -rin AuthUserFile * If there are uncommented lines pointing to files on disk using the above configuration option, this is a finding.
Fix: F-15451r276978_fix
Comment out the "AuthUserFile" lines found in the Apache configuration.
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- AS24-U1-000250
- Vuln IDs
-
- V-214240
- V-92641
- Rule IDs
-
- SV-214240r505935_rule
- SV-102729
Checks: C-15454r276980_chk
Verify the document root directory and the configuration files do not provide for default index.html or welcome page. Verify the Apache User Manual content is not installed by checking the configuration files for manual location directives. Verify the Apache configuration files do not have the Server Status handler configured. Verify the Server Information handler is not configured. Verify that any other handler configurations such as perl-status are not enabled. If any of these are present, this is a finding.
Fix: F-15452r276981_fix
Review all pre-installed content and remove content that is not required. In particular, look for the unnecessary content that may be found in the document root directory, a configuration directory such as conf/extra directory, or as a UNIX/Linux package. Remove the default index.html or welcome page if it is a separate package. If the default welcome page is part of the main Apache httpd package as it is on Red Hat Linux, then comment out the configuration as shown below. Removing a file such as "welcome.conf" is not recommended as it may be replaced if the package is updated. # # This configuration file enables the default "Welcome" # page if there is no default index page present for # the root URL. To disable the Welcome page, comment # out all the lines below. # ##<LocationMatch "^/+$"> ## Options -Indexes ## ErrorDocument 403 /error/noindex.html ##</LocationMatch> Remove the Apache User Manual content or comment out configurations referencing the manual. Example: # yum erase httpd-manual Remove or comment out any Server Status handler configuration: # # Allow server status reports generated by mod_status, # with the URL of http://servername/server-status # Change the ".example.com" to match your domain to enable. # ##<Location /server-status> ## SetHandler server-status ## Order deny,allow ## Deny from all ## Allow from .example.com ##</Location> Remove or comment out any Server Information handler configuration: # # Allow remote server configuration reports, with the URL of # http://servername/server-info (requires that mod_info.c be loaded). # Change the ".example.com" to match your domain to enable. # ##<Location /server-info> ## SetHandler server-info ## Order deny,allow ## Deny from all ## Allow from .example.com ##</Location> Remove or comment out any other handler configuration such as perl-status: # This will allow remote server configuration reports, with the URL of # http://servername/perl-status # Change the ".example.com" to match your domain to enable. # ##<Location /perl-status> ## SetHandler perl-script ## PerlResponseHandler Apache2::Status ## Order deny,allow ## Deny from all ## Allow from .example.com ##</Location> The default source build provides extra content available in the <'INSTALLED PATH'>/conf/extra/ directory, but the configuration of most of the extra content is commented out by default. In particular, the inclusion of conf/extra/proxyhtml.conf is not commented out in "httpd.conf": # Server-pool management (MPM specific) #Include conf/extra/httpd-mpm.conf # Multi-language error messages #Include conf/extra/httpd-multilang-errordoc.conf # Fancy directory listings #Include conf/extra/httpd-autoindex.conf # Language settings #Include conf/extra/httpd-languages.conf # User home directories #Include conf/extra/httpd-userdir.conf # Real-time info on requests and configuration #Include conf/extra/httpd-info.conf # Virtual hosts #Include conf/extra/httpd-vhosts.conf # Local access to the Apache HTTP Server Manual #Include conf/extra/httpd-manual.conf # Distributed authoring and versioning (WebDAV) #Include conf/extra/httpd-dav.conf # Various default settings #Include conf/extra/httpd-default.conf # Configure mod_proxy_html to understand HTML4/XHTML1 <IfModule proxy_html_module> Include conf/extra/proxy-html.conf </IfModule> # Secure (SSL/TLS) connections #Include conf/extra/httpd-ssl.conf For applications developed in-house, ensure that development artifacts (sample data and scripts; unused libraries, components, debug code; or tools) are not included in the deployed software or accessible in the production environment.
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- AS24-U1-000260
- Vuln IDs
-
- V-214241
- V-92643
- Rule IDs
-
- SV-214241r505935_rule
- SV-102731
Checks: C-15455r276983_chk
If the server is a proxy server and not a web server, this check is Not Applicable. In a command line, run "httpd -M | sort" to view a list of installed modules. If any of the following modules are present, this is a finding: proxy_module proxy_ajp_module proxy_balancer_module proxy_ftp_module proxy_http_module proxy_connect_module Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Search for the directive "ProxyRequest" in the "httpd.conf" file. If the ProxyRequest directive is set to “On”, this is a finding.
Fix: F-15453r276984_fix
Determine where the proxy modules are located by running the following command: grep -rl "proxy_module" <'INSTALL PATH'> Edit the file and comment out the following modules: proxy_module proxy_ajp_module proxy_balancer_module proxy_ftp_module proxy_http_module proxy_connect_module Comment out the ProxyRequext directive in the httpd.conf file. Restart Apache: apachectl restart
- RMF Control
- CM-7
- Severity
- H
- CCI
- CCI-000381
- Version
- AS24-U1-000270
- Vuln IDs
-
- V-214242
- V-92645
- Rule IDs
-
- SV-214242r505935_rule
- SV-102733
Checks: C-15456r276986_chk
If the site requires the use of a particular piece of software, verify that the Information System Security Officer (ISSO) maintains documentation identifying this software as necessary for operations. The software must be operated at the vendor’s current patch level and must be a supported vendor release. If programs or utilities that meet the above criteria are installed on the web server and appropriate documentation and signatures are in evidence, this is not a finding. Determine whether the web server is configured with unnecessary software. Determine whether processes other than those that support the web server are loaded and/or run on the web server. Examples of software that should not be on the web server are all web development tools, office suites (unless the web server is a private web development server), compilers, and other utilities that are not part of the web server suite or the basic operating system. Check the directory structure of the server and verify that additional, unintended, or unneeded applications are not loaded on the system. If, after review of the application on the system, there is no justification for the identified software, this is a finding.
Fix: F-15454r276987_fix
Remove any unnecessary applications per ISSO documentation.
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- AS24-U1-000300
- Vuln IDs
-
- V-214243
- V-92653
- Rule IDs
-
- SV-214243r505935_rule
- SV-102741
Checks: C-15457r276989_chk
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Review any "Action" or "AddHandler" directives: # cat /<path_to_file>/httpd.conf | grep -i "Action" # cat /<path_to_file>/httpd.conf | grep -i "AddHandler" If "Action" or "AddHandler" exist and they configure .exe, .dll, .com, .bat, or .csh, or any other shell as a viewer for documents, this is a finding. If this is not documented and approved by the Information System Security Officer (ISSO), this is a finding.
Fix: F-15455r276990_fix
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Disable MIME types for .exe, .dll, .com, .bat, and .csh programs. If "Action" or "AddHandler" exist within the "httpd.conf" file and they configure .exe, .dll, .com, .bat, or .csh, remove those references. Restart Apache: apachectl restart Ensure this process is documented and approved by the ISSO.
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- AS24-U1-000310
- Vuln IDs
-
- V-214244
- V-92655
- Rule IDs
-
- SV-214244r505935_rule
- SV-102743
Checks: C-15458r276992_chk
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Locate "cgi-bin" files and directories enabled in the Apache configuration via "Script", "ScriptAlias" or "ScriptAliasMatch", and "ScriptInterpreterSource" directives: # cat /<path_to_file>/httpd.conf | grep -i "Script" If any scripts are present that are not needed for application operation, this is a finding. If this is not documented and approved by the Information System Security Officer (ISSO), this is a finding.
Fix: F-15456r276993_fix
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Review "Script", "ScriptAlias" or "ScriptAliasMatch", and "ScriptInterpreterSource" directives. Go into each directory and locate "cgi-bin" files. Remove any script that is not needed for application operation. Ensure this process is documented and approved by the ISSO.
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- AS24-U1-000330
- Vuln IDs
-
- V-214245
- V-92659
- Rule IDs
-
- SV-214245r505935_rule
- SV-102747
Checks: C-15459r276995_chk
In a command line, run "httpd -M | sort" to view a list of installed modules. If any of the following modules are present, this is a finding: dav_module dav_fs_module dav_lock_module
Fix: F-15457r276996_fix
Determine where the "dav" modules are located by running the following command: grep -rl "dav_module" <'INSTALL PATH'> Edit the file and comment out the following modules: dav_module dav_fs_module dav_lock_module Restart Apache: apachectl restart
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000382
- Version
- AS24-U1-000360
- Vuln IDs
-
- V-214246
- V-92661
- Rule IDs
-
- SV-214246r505935_rule
- SV-102749
Checks: C-15460r276998_chk
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Search for the "Listen" directive: # cat /<path_to_file>/httpd.conf | grep -i "Listen" Verify that any enabled "Listen" directives specify both an IP address and port number. If the "Listen" directive is found with only an IP address or only a port number specified, this is finding. If the IP address is all zeros (i.e., 0.0.0.0:80 or [::ffff:0.0.0.0]:80), this is a finding. If the "Listen" directive does not exist, this is a finding.
Fix: F-15458r276999_fix
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Set the "Listen" directive to listen on a specific IP address and port. Restart Apache: apachectl restart
- RMF Control
- SC-2
- Severity
- M
- CCI
- CCI-001082
- Version
- AS24-U1-000430
- Vuln IDs
-
- V-214247
- V-92671
- Rule IDs
-
- SV-214247r505935_rule
- SV-102759
Checks: C-15461r277001_chk
Review the web server documentation and configuration to determine what web server accounts are available on the server. Any directories or files owned by anyone other than an administrative service account is a finding. If non-privileged web server accounts are available with access to functions, directories, or files not needed for the role of the account, this is a finding.
Fix: F-15459r277002_fix
Limit the functions, directories, and files that are accessible by each account and role to administrative service accounts and remove or modify non-privileged account access.
- RMF Control
- CM-7
- Severity
- H
- CCI
- CCI-000381
- Version
- AS24-U1-000440
- Vuln IDs
-
- V-214248
- V-92673
- Rule IDs
-
- SV-214248r505935_rule
- SV-102761
Checks: C-15462r505082_chk
Obtain a list of the user accounts for the system, noting the privileges for each account. Verify with the SA or the Information System Security Officer (ISSO) that all privileged accounts are mission essential and documented. Verify with the SA or the ISSO that all non-administrator access to shell scripts and operating system functions are mission essential and documented. If undocumented privileged accounts are present, this is a finding. If undocumented access to shell scripts or operating system functions is present, this is a finding.
Fix: F-15460r505083_fix
Ensure non-administrators are not allowed access to the directory tree, the shell, or other operating system functions and utilities.
- RMF Control
- SC-2
- Severity
- M
- CCI
- CCI-001082
- Version
- AS24-U1-000450
- Vuln IDs
-
- V-214249
- V-92675
- Rule IDs
-
- SV-214249r505935_rule
- SV-102763
Checks: C-15463r277007_chk
Review the web server documentation and deployed configuration to determine whether hosted application functionality is separated from web server management functions. If the functions are not separated, this is a finding.
Fix: F-15461r277008_fix
Configure Apache to separate the hosted applications from web server management functionality.
- RMF Control
- SC-23
- Severity
- M
- CCI
- CCI-001185
- Version
- AS24-U1-000460
- Vuln IDs
-
- V-214250
- V-92677
- Rule IDs
-
- SV-214250r505935_rule
- SV-102765
Checks: C-15464r277010_chk
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Search for the following directive: "SessionMaxAge" # cat /<path_to_file>/httpd.conf | grep -i "SessionMaxAge" Verify the value of "SessionMaxAge" is set to "600" or less. If the "SessionMaxAge" does not exist or is set to more than "600", this is a finding.
Fix: F-15462r277011_fix
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Add the following line to the "httpd.conf" file: SessionMaxAge 600 Restart Apache: apachectl restart
- RMF Control
- SC-23
- Severity
- M
- CCI
- CCI-001664
- Version
- AS24-U1-000470
- Vuln IDs
-
- V-214251
- V-92679
- Rule IDs
-
- SV-214251r505935_rule
- SV-102767
Checks: C-15465r457879_chk
Note: For web servers acting as a public facing with static content that do not require authentication, this is Not Applicable. Review the web server documentation and configuration to determine if cookies between the web server and client are accessible by applications or web servers other than the originating pair. grep SessionCookieName <'INSTALL LOCATION'>/mod_session.conf Confirm that the "HttpOnly" and "Secure" settings are present in the line returned. Confirm that the line does not contain the "Domain" cookie setting. Verify the "headers_module (shared)" module is loaded in the web server: "# httpd -M Verify " headers_module (shared)" is returned in the list of Loaded Modules from the above command." If the "headers_module (shared)" is not loaded, this is a finding.
Fix: F-15463r277014_fix
Edit the "mod_session.conf" file and find the "SessionCookieName" directive. Set the "SessionCookieName" to "session path=/; HttpOnly; Secure; " Example: SessionCookieName session path=/; HttpOnly; Secure; Restart Apache: apachectl restart
- RMF Control
- SC-23
- Severity
- M
- CCI
- CCI-001188
- Version
- AS24-U1-000510
- Vuln IDs
-
- V-214252
- V-92687
- Rule IDs
-
- SV-214252r505935_rule
- SV-102775
Checks: C-15466r277016_chk
Review the web server documentation and deployed configuration to determine the length of the generated session identifiers. First ensure that "session_crypto" is enabled: httpd -M |grep session_crypto If the above command returns "session_crypto_module", the module is enabled in the running server. Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Review the "httpd.conf" file. If the "SessionCryptoCipher" is not used or "SessionCryptoCipher" is not set to "aes256", this is a finding.
Fix: F-15464r277017_fix
Configure the web server to generate session identifiers that are at least 128 bits in length. Ensure that "session_crypto_module" is enabled. Determine the location of the "httpd.conf" file by running the following command: httpd -V Review the "HTTPD_ROOT" path. Navigate to the "HTTPD_ROOT"/conf directory. Edit the "httpd.conf" file. SessionCryptoCipher aes256 Restart Apache: apachectl restart
- RMF Control
- SC-23
- Severity
- H
- CCI
- CCI-001188
- Version
- AS24-U1-000520
- Vuln IDs
-
- V-214253
- V-92689
- Rule IDs
-
- SV-214253r505935_rule
- SV-102777
Checks: C-15467r277019_chk
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Verify the "unique_id_module" is loaded: run httpd -M | grep unique_id If no unique_id is returned, open finding.
Fix: F-15465r277020_fix
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Load the "unique_id_module". Example: LoadModule unique_id_module modules/mod_unique_id.so Restart Apache: apachectl restart
- RMF Control
- SC-24
- Severity
- M
- CCI
- CCI-001190
- Version
- AS24-U1-000550
- Vuln IDs
-
- V-214254
- V-92695
- Rule IDs
-
- SV-214254r505935_rule
- SV-102783
Checks: C-15468r277022_chk
Interview the System Administrator for the Apache 2.4 web server. Ask for documentation on the disaster recovery methods tested and planned for the Apache 2.4 web server in the event of the necessity for rollback. If documentation for a disaster recovery has not been established, this is a finding.
Fix: F-15466r277023_fix
Prepare documentation for disaster recovery methods for the Apache 2.4 web server in the event of the necessity for rollback. Document and test the disaster recovery methods designed.
- RMF Control
- SC-5
- Severity
- M
- CCI
- CCI-001094
- Version
- AS24-U1-000590
- Vuln IDs
-
- V-214255
- V-92697
- Rule IDs
-
- SV-214255r505935_rule
- SV-102785
Checks: C-15469r277025_chk
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Verify that the "Timeout" directive is specified to have a value of "10" seconds or less. # cat /<path_to_file>/httpd.conf | grep -i "Timeout" If the "Timeout" directive is not configured or is set for more than "10" seconds, this is a finding.
Fix: F-15467r277026_fix
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Add or modify the "Timeout" directive to have a value of "10" seconds or less: "Timeout 10"
- RMF Control
- SI-11
- Severity
- M
- CCI
- CCI-001312
- Version
- AS24-U1-000620
- Vuln IDs
-
- V-214256
- V-92699
- Rule IDs
-
- SV-214256r505935_rule
- SV-102787
Checks: C-15470r277028_chk
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" If the "ErrorDocument" directive is not being used for custom error pages for "4xx" or "5xx" HTTP status codes, this is a finding. # cat /<path_to_file>/httpd.conf | grep -i "ErrorDocument"
Fix: F-15468r277029_fix
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Use the "ErrorDocument" directive to enable custom error pages for 4xx or 5xx HTTP status codes. ErrorDocument 500 "Sorry, our script crashed. Oh dear" ErrorDocument 500 /cgi-bin/crash-recover ErrorDocument 500 http://error.example.com/server_error.html ErrorDocument 404 /errors/not_found.html ErrorDocument 401 /subscription/how_to_subscribe.html The syntax of the ErrorDocument directive is: ErrorDocument <3-digit-code> <action> Additional information: https://httpd.apache.org/docs/2.4/custom-error.html
- RMF Control
- SI-11
- Severity
- M
- CCI
- CCI-001312
- Version
- AS24-U1-000630
- Vuln IDs
-
- V-214257
- V-92701
- Rule IDs
-
- SV-214257r505935_rule
- SV-102789
Checks: C-15471r277031_chk
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" For any enabled "TraceEnable" directives, verify they are part of the server-level configuration (i.e., not nested in a "Directory" or "Location" directive). Verify that the "TraceEnable" directive is set to "Off": # cat /<path_to_file>/httpd.conf | grep -i "TraceEnable" If the "TraceEnable" directive is not part of the server-level configuration and/or is not set to "Off", this is a finding. If the directive does not exist in the "conf" file, this is a finding because the default value is "On". If the "LogLevel" directive is not being used, this is a finding: # cat /<path_to_file>/httpd.conf | grep -i "LogLevel"
Fix: F-15469r277032_fix
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Add or set the value of "TraceEnable" to "Off". Set the "LogLevel" directive to "info" or below.
- RMF Control
- AC-12
- Severity
- M
- CCI
- CCI-002361
- Version
- AS24-U1-000650
- Vuln IDs
-
- V-214258
- V-92705
- Rule IDs
-
- SV-214258r557318_rule
- SV-102793
Checks: C-15472r557316_chk
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Verify the "reqtimeout_module" is loaded: # cat /<path_to_file>/httpd.conf | grep -i "reqtimeout_module" If the "reqtimeout_module" is not loaded, this is a finding. Verify the "RequestReadTimeout" directive is configured. Example: RequestReadTimeout handshake=5 header=10 body=30 Allows for 5 seconds to complete the TLS handshake, 10 seconds to receive the request headers and 30 seconds for receiving the request body. The values will depend upon the website. The intent of this requirement is to ensure the RequestReadTimeout is explicitly configured. If the "reqtimeout_module" is loaded and the "RequestReadTimeout" directive is not configured, this is a finding.
Fix: F-15470r557317_fix
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Load the "reqtimeout_module". Set the "RequestReadTimeout" directive to specific values applicable to the website.
- RMF Control
- AC-17
- Severity
- M
- CCI
- CCI-002314
- Version
- AS24-U1-000670
- Vuln IDs
-
- V-214259
- V-92709
- Rule IDs
-
- SV-214259r505935_rule
- SV-102797
Checks: C-15473r277037_chk
If external controls such as host-based firewalls are used to restrict this access, this check is Not Applicable. Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Search for the "RequireAll" directive: # cat /<path_to_file>/httpd.conf | grep -i "RequireAll" If "RequireAll" is not configured or IP ranges configured to allow are not restrictive enough to prevent connections from nonsecure zones, this is a finding.
Fix: F-15471r277038_fix
Configure the "http.conf" file to include restrictions. Example: <RequireAll> Require not ip 192.168.205 Require not host phishers.example.com </RequireAll>
- RMF Control
- AC-17
- Severity
- M
- CCI
- CCI-002322
- Version
- AS24-U1-000680
- Vuln IDs
-
- V-214260
- V-92711
- Rule IDs
-
- SV-214260r505935_rule
- SV-102799
Checks: C-15474r277040_chk
Interview the SA and Web Manager. Ask for documentation for the Apache web server administration. Verify there are documented procedures for shutting down an Apache website in the event of an attack. The procedure should, at a minimum, provide the following steps: Determine the respective website for the application at risk of an attack. Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" In a command line, enter the following command: "kill -TERM `cat <'INSTALLED PATH'>/logs/httpd.pid`" If the web server is not capable of or cannot be configured to disconnect or disable remote access to the hosted applications when necessary, this is a finding.
Fix: F-15472r277041_fix
Prepare documented procedures for shutting down an Apache website in the event of an attack. The procedure should, at a minimum, provide the following steps: In a command line, enter the following command: "kill -TERM `cat <'INSTALLED PATH'>/logs/httpd.pid`"
- RMF Control
- AC-6
- Severity
- M
- CCI
- CCI-002235
- Version
- AS24-U1-000690
- Vuln IDs
-
- V-214261
- V-92713
- Rule IDs
-
- SV-214261r505935_rule
- SV-102801
Checks: C-15475r277043_chk
Determine which tool or control file is used to control the configuration of the web server. If the control of the web server is done via control files, verify who has update access to them. If tools are being used to configure the web server, determine who has access to execute the tools. If accounts other than the System Administrator (SA), the Web Manager, or the Web Manager designees have access to the web administration tool or control files, this is a finding.
Fix: F-15473r277044_fix
Restrict access to the web administration tool to only the System Administrator, Web Manager, or the Web Manager designees.
- RMF Control
- AU-4
- Severity
- M
- CCI
- CCI-001849
- Version
- AS24-U1-000710
- Vuln IDs
-
- V-214262
- V-92715
- Rule IDs
-
- SV-214262r505935_rule
- SV-102803
Checks: C-15476r277046_chk
Work with SIEM administrator to determine log storage capacity. If there is no setting within a SIEM to accommodate enough a large logging capacity, this is a finding.
Fix: F-15474r277047_fix
Work with the SIEM administrator to determine if the SIEM is configured to allocate log record storage capacity large enough to accommodate the logging requirements of the Apache web server.
- RMF Control
- AU-4
- Severity
- M
- CCI
- CCI-001851
- Version
- AS24-U1-000720
- Vuln IDs
-
- V-214263
- V-92717
- Rule IDs
-
- SV-214263r505935_rule
- SV-102805
Checks: C-15477r277049_chk
Work with SIEM administrator to determine audit configurations. If there is a setting within the SIEM that could impede the ability to write specific log record content, this is a finding.
Fix: F-15475r277050_fix
Work with the SIEM administrator to allow the ability to write specified log record content to an audit log server.
- RMF Control
- AU-4
- Severity
- M
- CCI
- CCI-001851
- Version
- AS24-U1-000730
- Vuln IDs
-
- V-214264
- V-92719
- Rule IDs
-
- SV-214264r505935_rule
- SV-102807
Checks: C-15478r277052_chk
Work with the SIEM administrator to determine current security integrations. If the SIEM is not integrated with security, this is a finding.
Fix: F-15476r277053_fix
Work with the SIEM administrator to integrate with an organizations security infrastructure.
- RMF Control
- AU-8
- Severity
- M
- CCI
- CCI-001889
- Version
- AS24-U1-000750
- Vuln IDs
-
- V-214265
- V-92723
- Rule IDs
-
- SV-214265r505935_rule
- SV-102811
Checks: C-15479r277055_chk
Review the web server documentation and configuration to determine the time stamp format for log data. Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Search for the "log_config_module" directive: # cat /<path_to_file>/httpd.conf | grep -i "LogFormat" Verify the "LogFormat" directive exists. If the "LogFormat" directive does not exist, this is a finding. Verify the "LogFormat" line contains the "%t" flag. If "%t" flag is not present, time is not mapped to UTC or GMT time, this is a finding.
Fix: F-15477r277056_fix
In a command line, run "httpd -M" to view a list of installed modules. If "log_config_module" is not listed, enable this module. Review the "httpd.conf" file. Determine if the "LogFormat" directive exists. If it does not exist, ensure the "LogFormat" line contains the %t flag.
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-001762
- Version
- AS24-U1-000780
- Vuln IDs
-
- V-214266
- V-92727
- Rule IDs
-
- SV-214266r505935_rule
- SV-102815
Checks: C-15480r277058_chk
Review the website to determine if HTTP and HTTPs are used in accordance with well known ports (e.g., 80 and 443) or those ports and services as registered and approved for use by the DoD PPSM. Any variation in PPS will be documented, registered, and approved by the PPSM. If not, this is a finding.
Fix: F-15478r277059_fix
Ensure the website enforces the use of IANA well-known ports for HTTP and HTTPS.
- RMF Control
- SC-5
- Severity
- M
- CCI
- CCI-002385
- Version
- AS24-U1-000820
- Vuln IDs
-
- V-214267
- V-92731
- Rule IDs
-
- SV-214267r505935_rule
- SV-102819
Checks: C-15481r277061_chk
Review the web server documentation and deployed configuration to determine where the process ID is stored and which utilities are used to start/stop the web server. Determine where the "httpd.pid" file is located by running the following command: find / -name "httpd.pid" This file is automatically generated upon service start. Verify the file owner/group is of an administrative service account: ls -lah <'httpd.pid location'>/httpd.pid If the file owner/group is not an administrative service account, this is a finding. Verify the service utilities used to manage the Apache service owner/group is of an administrative service account. ls -lah /usr/sbin/service ls -lah /usr/sbin/apachectl If the service utilities owner/group is not an administrative service account, this is a finding. Determine whether the process ID and the utilities are protected from non-privileged users. If the process ID and the utilities are not protected from non-privileged users, this is a finding.
Fix: F-15479r277062_fix
Review the web server documentation and deployed configuration to determine where the process ID is stored and which utilities are used to start/stop the web server. Determine where the "httpd.pid" file is located by running the following command: find / -name "httpd.pid" Run the following commands: # cd <'httpd.pid location'>/ # chown <'service account'> httpd.pid # chmod 644 httpd.pid # cd /usr/sbin # chown <'service account'> service apachectl # chmod 755 service apachectl
- RMF Control
- SC-8
- Severity
- M
- CCI
- CCI-002418
- Version
- AS24-U1-000870
- Vuln IDs
-
- V-214268
- V-92741
- Rule IDs
-
- SV-214268r505935_rule
- SV-102829
Checks: C-15482r277064_chk
In a command line, run "httpd -M | grep -i session_cookie_module". Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Search for the directive "Session" in the "httpd.conf" file: # cat /<path_to_file>/httpd.conf | grep -i "Session" If the "Session" and "SessionCookieName" directives are not present, this is a finding. If "Session" is not set to "on" and "SessionCookieName" does not contain "httpOnly" and "secure", this is a finding.
Fix: F-15480r277065_fix
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Set "Session" to "on". Ensure the "SessionCookieName" directive includes "httpOnly" and "secure".
- RMF Control
- SC-8
- Severity
- M
- CCI
- CCI-002418
- Version
- AS24-U1-000900
- Vuln IDs
-
- V-214269
- V-92745
- Rule IDs
-
- SV-214269r505935_rule
- SV-102833
Checks: C-15483r505085_chk
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" and "ssl.conf" files: Open the httpd.conf and ssl.conf file with an editor and search for the following uncommented directive: SSLCipherSuite For all enabled SSLCipherSuite directives, ensure the cipher specification string contains the kill cipher from list option for all export cipher suites, i.e., !EXPORT, which may be abbreviated !EXP as in the following example: Example: SSLCipherSuite="HIGH:MEDIUM:!MD5!EXP:!NULL:!LOW:!ADH If the SSLCipherSuite directive does not contain !EXPORT or !EXP or there are no enabled SSLCipherSuite directives, this is a finding.
Fix: F-15481r505086_fix
Update the cipher specification string for all enabled SSLCipherSuite directives to include !EXPORT.
- RMF Control
- SI-2
- Severity
- M
- CCI
- CCI-002605
- Version
- AS24-U1-000930
- Vuln IDs
-
- V-214270
- V-92749
- Rule IDs
-
- SV-214270r505935_rule
- SV-102837
Checks: C-15484r277070_chk
Determine the most recent patch level of the Apache Web Server 2.4 software, as posted on the Apache HTTP Server Project website. In a command line, type "httpd -v". If the version is more than one version behind the most recent patch level, this is a finding.
Fix: F-15482r277071_fix
Install the current version of the web server software and maintain appropriate service packs and patches.
- RMF Control
- CM-6
- Severity
- H
- CCI
- CCI-000366
- Version
- AS24-U1-000940
- Vuln IDs
-
- V-214271
- V-92751
- Rule IDs
-
- SV-214271r505935_rule
- SV-102839
Checks: C-15485r277073_chk
Identify the account that is running the "httpd" process: # ps -ef | grep -i httpd | grep -v grep apache 29613 996 0 Feb17 ? 00:00:00 /usr/sbin/httpd apache 29614 996 0 Feb17 ? 00:00:00 /usr/sbin/httpd Check to see if the account has a valid login shell: # cut -d: -f1,7 /etc/passwd | grep -i <service_account> apache:/sbin/nologin If the service account has a valid login shell, verify that no password is configured for the account: # cut -d: -f1,2 /etc/shadow | grep -i <service_account> apache:!! If the account has a valid login shell and a password defined, this is a finding.
Fix: F-15483r277074_fix
Update the /etc/passwd file to assign the account used to run the "httpd" process an invalid login shell such as "/sbin/nologin". Lock the account used to run the "httpd" process: # passwd -l <account> Locking password for user <account> passwd: Success
- RMF Control
- CM-6
- Severity
- L
- CCI
- CCI-000366
- Version
- AS24-U1-000950
- Vuln IDs
-
- V-214272
- V-92753
- Rule IDs
-
- SV-214272r505935_rule
- SV-102841
Checks: C-15486r277076_chk
Review the website to determine if "HTTP" and "HTTPS" are used in accordance with well-known ports (e.g., 80 and 443) or those ports and services as registered and approved for use by the DoD Ports, Protocols, and Services Management (PPSM). Verify that any variation in PPS is documented, registered, and approved by the PPSM. If well-known ports and services are not approved for used by PPSM, this is a finding.
Fix: F-15484r277077_fix
Ensure the website enforces the use of IANA well-known ports for "HTTP" and "HTTPS".
- RMF Control
- CM-6
- Severity
- H
- CCI
- CCI-000366
- Version
- AS24-U1-000960
- Vuln IDs
-
- V-214273
- V-92755
- Rule IDs
-
- SV-214273r505935_rule
- SV-102843
Checks: C-15487r277079_chk
Determine the version of the Apache software that is running on the system by entering the following command: httpd -v If the version of Apache is not at the following version or higher, this is a finding: Apache 2.4 (February 2012) NOTE: In some situations, the Apache software that is being used is supported by another vendor, such as Oracle in the case of the Oracle Application Server or IBM's HTTP Server. The versions of the software in these cases may not match the version number noted above. If the site can provide vendor documentation showing the version of the web server is supported, this would not be a finding.
Fix: F-15485r277080_fix
Install the current version of the web server software and maintain appropriate service packs and patches.
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- AS24-U1-000970
- Vuln IDs
-
- V-214274
- V-92757
- Rule IDs
-
- SV-214274r505935_rule
- SV-102845
Checks: C-15488r277082_chk
Locate the htpasswd file by entering the following command: find / -name htpasswd Navigate to that directory. Run: ls -l htpasswd Permissions should be: r-x r - x - - - (550) If permissions on "htpasswd" are greater than "550", this is a finding. Verify the owner is the SA or Web Manager account. If another account has access to this file, this is a finding.
Fix: F-15486r277083_fix
Ensure the SA or Web Manager account owns the "htpasswd" file. Ensure permissions are set to "550".
- RMF Control
- SC-3
- Severity
- M
- CCI
- CCI-001084
- Version
- AS24-U1-001000
- Vuln IDs
-
- V-214275
- V-92759
- Rule IDs
-
- SV-214275r505935_rule
- SV-102847
Checks: C-15489r277085_chk
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Enter the following command into a command line: more <'INSTALLED PATH'>/conf/httpd.conf For every enabled "Directory" directive (except root), verify the following entry exists: <LimitExcept GET POST OPTIONS> Require all denied </LimitExcept> If the statement above is not found in the "LimitExcept" statement (i.e., <Directory />), this is a finding. If the statement above is found enabled but without the appropriate "LimitExcept" or "Order" statement, this is a finding. If the statement is not found inside an enabled "Directory" directive, this is a finding. NOTE: If the "LimitExcept" statement above is operationally limiting, this should be explicitly documented and approved by the ISSO, at which point this can be considered not a finding.
Fix: F-15487r277086_fix
Edit the "httpd.conf" file and add the following entries for every enabled "Directory" directive (except root). <LimitExcept GET POST OPTIONS> Require all denied </LimitExcept> Example: <Directory "/usr/local/apache2/cgi-bin"> . . . # Limit HTTP methods <LimitExcept GET POST OPTIONS> Require all denied </LimitExcept> </Directory>