Apache Server 2.4 Windows Server Security Technical Implementation Guide
Pick two releases to diff their requirements.
Open a previous version of this STIG.
Digest of Updates +55 −74
Comparison against the immediately-prior release (V1R0.1). Rule matching uses the Group Vuln ID. Content-change detection compares the rule’s description, check, and fix text after stripping inline markup — cosmetic-only edits aren’t flagged.
Added rules 55
- V-92327 Medium The Apache web server must limit the number of allowed simultaneous session requests.
- V-92329 Medium The Apache web server must perform server-side session management.
- V-92331 Medium The Apache web server must use encryption strength in accordance with the categorization of data hosted by the Apache web server when remote connections are provided.
- V-92337 Medium System logging must be enabled.
- V-92339 Medium The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
- V-92343 Medium The Apache web server must produce log records containing sufficient information to establish what type of events occurred.
- V-92351 Medium An Apache web server, behind a load balancer or proxy server, must produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
- V-92357 Medium The Apache web server must use a logging mechanism that is configured to alert the (ISSO) and System Administrator (SA) in the event of a processing failure.
- V-92359 Medium The Apache web server log files must only be accessible by privileged users.
- V-92363 Medium The log information from the Apache web server must be protected from unauthorized deletion and modification.
- V-92365 Medium The log data and records from the Apache web server must be backed up onto a different system or media.
- V-92367 Medium Expansion modules must be fully reviewed, tested, and signed before they can exist on a production Apache web server.
- V-92369 Medium The Apache web server must not perform user management for hosted applications.
- V-92371 Medium The Apache web server must only contain services and functions necessary for operation.
- V-92373 Medium The Apache web server must not be a proxy server.
- V-92375 High The Apache web server must provide install options to exclude the installation of documentation, sample code, example applications, and tutorials.
- V-92377 High Apache web server application directories, libraries, and configuration files must only be accessible to privileged users.
- V-92381 Medium The Apache web server must have resource mappings set to disable the serving of certain file types.
- V-92383 Medium The Apache web server must allow the mappings to unused and vulnerable scripts to be removed.
- V-92387 Medium The Apache web server must have Web Distributed Authoring (WebDAV) disabled.
- V-92389 Medium The Apache web server must be configured to use a specified IP address and port.
- V-92391 Medium The Apache web server must encrypt passwords during transmission.
- V-92393 Medium The Apache web server must perform RFC 5280-compliant certification path validation.
- V-92399 Medium Apache web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.
- V-92403 Medium The Apache web server must separate the hosted applications from hosted Apache web server management functionality.
- V-92405 Medium The Apache web server must invalidate session identifiers upon hosted application user logout or other session termination.
- V-92407 Medium Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application.
- V-92409 Medium The Apache web server must accept only system-generated session identifiers.
- V-92413 Medium The Apache web server must generate unique session identifiers that cannot be reliably reproduced.
- V-92419 Medium The Apache web server must generate unique session identifiers with definable entropy.
- V-92423 Medium The Apache web server must be built to fail to a known safe state if system initialization fails, shutdown fails, or aborts fail.
- V-92425 Medium The Apache web server document directory must be in a separate partition from the Apache web servers system files.
- V-92427 Medium The Apache web server must restrict the ability of users to launch denial-of-service (DoS) attacks against other information systems or networks.
- V-92429 Medium Warning and error messages displayed to clients must be modified to minimize the identity of the Apache web server, patches, loaded modules, and directory paths.
- V-92431 Medium Debugging and trace information used to diagnose the Apache web server must be disabled.
- V-92433 Medium The Apache web server must set an absolute timeout for sessions.
- V-92435 Medium The Apache web server must set an inactive timeout for sessions.
- V-92439 Medium The Apache web server must restrict inbound connections from nonsecure zones.
- V-92441 Medium The Apache web server must be configured to immediately disconnect or disable remote access to the hosted applications.
- V-92443 Medium Non-privileged accounts on the hosting system must only access Apache web server security-relevant information and functions through a distinct administrative account.
- V-92445 Medium An Apache web server that is part of a web server cluster must route all remote management through a centrally managed access control point.
- V-92447 Medium The Apache web server must use a logging mechanism that is configured to allocate log record storage capacity large enough to accommodate the logging requirements of the Apache web server.
- V-92449 Medium The Apache web server must not impede the ability to write specified log record content to an audit log server.
- V-92451 Medium The Apache web server must be configurable to integrate with an organizations security infrastructure.
- V-92455 Medium The Apache web server must use a logging mechanism that is configured to provide a warning to the Information System Security Officer (ISSO) and System Administrator (SA) when allocated record storage volume reaches 75% of maximum log record storage capacity.
- V-92463 Medium The Apache web server must be protected from being stopped by a non-privileged user.
- V-92465 Medium The Apache web server must be tuned to handle the operational requirements of the hosted application.
- V-92469 Medium The Apache web server cookies, such as session cookies, sent to the client using SSL/TLS must not be compressed.
- V-92475 Medium The Apache web server must install security-relevant software updates within the configured time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).
- V-92477 High All accounts installed with the Apache web server software and tools must have passwords assigned and default passwords changed.
- V-92479 Low The Apache web server must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.
- V-92481 High The Apache web server software must be a vendor-supported version.
- V-92845 Medium The Apache web server must only accept client certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).
- V-94855 Medium The Apache web server must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
- V-94857 Medium The Apache web server must generate log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) with a minimum granularity of one second.
Removed rules 74
- AS24-W1-000010 Medium The Apache web server must limit the number of allowed simultaneous session requests.
- AS24-W1-000020 Medium The Apache web server must perform server-side session management.
- AS24-W1-000030 Medium The Apache web server must use encryption strength in accordance with the categorization of data hosted by the Apache web server when remote connections are provided.
- AS24-W1-000040 Medium The Apache web server must use cryptography to protect the integrity of remote sessions.
- AS24-W1-000060 Medium The Apache web server must enforce approved authorizations for logical access to hosted applications and resources in accordance with applicable access control policies.
- AS24-W1-000070 Medium The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
- AS24-W1-000080 Medium The Apache web server must initiate session logging upon startup.
- AS24-W1-000090 Medium The Apache web server must produce log records containing sufficient information to establish what type of events occurred.
- AS24-W1-000100 Medium The Apache web server must produce log records containing sufficient information to establish when (date and time) events occurred.
- AS24-W1-000110 Medium The Apache web server must produce log records containing sufficient information to establish where within the Apache web server the events occurred.
- AS24-W1-000120 Medium The Apache web server must produce log records containing sufficient information to establish the source of events.
- AS24-W1-000130 Medium An Apache web server, behind a load balancer or proxy server, must produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
- AS24-W1-000140 Medium The Apache web server must produce log records that contain sufficient information to establish the outcome (success or failure) of events.
- AS24-W1-000150 Medium The Apache web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.
- AS24-W1-000180 Medium The Apache web server log files must only be accessible by privileged users.
- AS24-W1-000190 Medium The log information from the Apache web server must be protected from unauthorized modification.
- AS24-W1-000200 Medium The log information from the Apache web server must be protected from unauthorized deletion.
- AS24-W1-000210 Medium The log data and records from the Apache web server must be backed up onto a different system or media.
- AS24-W1-000230 Medium Expansion modules must be fully reviewed, tested, and signed before they can exist on a production Apache web server.
- AS24-W1-000240 Medium The Apache web server must not perform user management for hosted applications.
- AS24-W1-000250 Medium The Apache web server must only contain services and functions necessary for operation.
- AS24-W1-000260 Medium The Apache web server must not be a proxy server.
- AS24-W1-000270 High The Apache web server must provide install options to exclude the installation of documentation, sample code, example applications, and tutorials.
- AS24-W1-000280 High The Apache Web server accounts not used by installed features (i.e., tools, utilities, specific services, etc.) must not be created and must be deleted when the Apache web server feature is uninstalled.
- AS24-W1-000290 Medium The Apache web server must provide options to remove or disable all utility programs not necessary for operations.
- AS24-W1-000300 Medium The Apache web server must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.
- AS24-W1-000310 Medium The Apache web server must allow the mappings to unused and vulnerable scripts to be removed.
- AS24-W1-000320 Medium The Apache web server must have resource mappings set to disable the serving of certain file types.
- AS24-W1-000330 Medium The Apache web server must have Web Distributed Authoring (WebDAV) disabled.
- AS24-W1-000360 Medium The Apache web server must be configured to use a specified IP address and port.
- AS24-W1-000370 Medium The Apache web server must encrypt passwords during transmission.
- AS24-W1-000380 Medium The Apache web server must perform RFC 5280-compliant certification path validation.
- AS24-W1-000400 Medium The Apache web server must use cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when encrypting stored data.
- AS24-W1-000410 Medium The Apache web server must use cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
- AS24-W1-000430 Medium Apache web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.
- AS24-W1-000440 High Anonymous user access to the Apache web server application directories must be prohibited.
- AS24-W1-000450 Medium The Apache web server must separate the hosted applications from hosted Apache web server management functionality.
- AS24-W1-000460 Medium The Apache web server must invalidate session identifiers upon hosted application user logout or other session termination.
- AS24-W1-000470 Medium Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application.
- AS24-W1-000480 Medium The Apache web server must accept only system-generated session identifiers.
- AS24-W1-000490 Medium The Apache web server must generate a unique session identifier for each session using a FIPS 140-2 approved random number generator.
- AS24-W1-000500 Medium The Apache web server must generate unique session identifiers that cannot be reliably reproduced.
- AS24-W1-000510 Medium The Apache web server must generate a session ID long enough that it cannot be guessed through brute force.
- AS24-W1-000520 Medium The Apache web server must generate a session ID using as much of the character set as possible to reduce the risk of brute force.
- AS24-W1-000530 Medium The Apache web server must generate unique session identifiers with definable entropy.
- AS24-W1-000540 Medium The Apache web server must augment re-creation to a stable and known baseline.
- AS24-W1-000550 Medium The Apache web server must be built to fail to a known safe state if system initialization fails, shutdown fails, or aborts fail.
- AS24-W1-000580 Medium The Apache web server document directory must be in a separate partition from the Apache web servers system files.
- AS24-W1-000590 Medium The Apache web server must restrict the ability of users to launch denial-of-service (DoS) attacks against other information systems or networks.
- AS24-W1-000620 Medium Warning and error messages displayed to clients must be modified to minimize the identity of the Apache web server, patches, loaded modules, and directory paths.
- AS24-W1-000630 Medium Debugging and trace information used to diagnose the Apache web server must be disabled.
- AS24-W1-000640 Medium The Apache web server must set an absolute timeout for sessions.
- AS24-W1-000650 Medium The Apache web server must set an inactive timeout for sessions.
- AS24-W1-000660 High Remote access to the Apache web server must follow access policy or work in conjunction with enterprise tools designed to enforce policy requirements.
- AS24-W1-000670 Medium The Apache web server must restrict inbound connections from nonsecure zones.
- AS24-W1-000680 Medium The Apache web server must be configured to immediately disconnect or disable remote access to the hosted applications.
- AS24-W1-000690 Medium Non-privileged accounts on the hosting system must only access Apache web server security-relevant information and functions through a distinct administrative account.
- AS24-W1-000700 Medium An Apache web server that is part of a web server cluster must route all remote management through a centrally managed access control point.
- AS24-W1-000750 Medium The Apache web server must generate log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).
- AS24-W1-000760 Medium The Apache web server must record time stamps for log records to a minimum granularity of one second.
- AS24-W1-000770 Medium The Apache web server application, libraries, and configuration files must only be accessible to privileged users.
- AS24-W1-000790 Medium The Apache web server must implement required cryptographic protections using cryptographic modules complying with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when encrypting data that must be compartmentalized.
- AS24-W1-000800 Medium The Apache web server must only accept client certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).
- AS24-W1-000820 Medium The Apache web server must be protected from being stopped by a non-privileged user.
- AS24-W1-000830 Medium The Apache web server must be tuned to handle the operational requirements of the hosted application.
- AS24-W1-000850 Medium The Apache web server session IDs must be sent to the client using SSL/TLS.
- AS24-W1-000860 Medium The Apache web server cookies, such as session cookies, sent to the client using SSL/TLS must not be compressed.
- AS24-W1-000870 Medium Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data.
- AS24-W1-000900 Medium The Apache web server must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
- AS24-W1-000920 Medium The Apache web server must maintain the confidentiality and integrity of information during reception.
- AS24-W1-000930 Medium The Apache web server must install security-relevant software updates within the configured time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).
- AS24-W1-000940 High All accounts installed with the Apache web server software and tools must have passwords assigned and default passwords changed.
- AS24-W1-000950 Low The Apache web server must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.
- AS24-W1-000960 High The Apache web server software must be a vendor-supported version.
- RMF Control
- AC-10
- Severity
- M
- CCI
- CCI-000054
- Version
- AS24-W1-000010
- Vuln IDs
-
- V-92327
- Rule IDs
-
- SV-102415r1_rule
Checks: C-91623r2_chk
With an editor, open the configuration file: <installed path>\Apache24\conf\extra\httpd-default Search for the following directive: MaxKeepAliveRequests Verify the value is "100" or greater. If the "MaxKeepAliveRequests" directive is not "100" or greater, this is a finding.
Fix: F-98565r3_fix
With an editor, open the configuration file: <installed path>\conf\extra\httpd-default Search for the following directive: MaxKeepAliveRequests Set the "MaxKeepAliveRequests" directive to a value of "100" or greater. Add the "MaxKeepAliveRequests" directive if it does not exist. It is recommended that the "MaxKeepAliveRequests" directive be explicitly set to prevent unexpected results if the defaults change with updated software.
- RMF Control
- AC-10
- Severity
- M
- CCI
- CCI-000054
- Version
- AS24-W1-000020
- Vuln IDs
-
- V-92329
- Rule IDs
-
- SV-102417r1_rule
Checks: C-91625r1_chk
In a command line, navigate to "<'INSTALLED PATH'>\bin". Run "httpd -M" to view a list of installed modules. If "mod_session" module and "mod_usertrack" are not enabled, this is a finding. session_module (shared) usertrack_module (shared)
Fix: F-98567r1_fix
Uncomment the "usertrack_module" module line and the "session_module" module in the <'INSTALL PATH'>\conf\httpd.conf file. Restart the Apache service. Additional documentation can be found at: https://httpd.apache.org/docs/2.4/mod/mod_usertrack.html https://httpd.apache.org/docs/2.4/mod/mod_session.html
- RMF Control
- AC-17
- Severity
- M
- CCI
- CCI-000068
- Version
- AS24-W1-000030
- Vuln IDs
-
- V-92331
- Rule IDs
-
- SV-102419r1_rule
Checks: C-91627r1_chk
In a command line, navigate to "<'INSTALLED PATH'>\bin". Run "httpd -M" to view a list of installed modules. If the "ssl_module" is not enabled, this is a finding. Review the <'INSTALL PATH'>\conf\httpd.conf file to determine if the "SSLProtocol" directive exists and looks like the following: SSLProtocol -ALL +TLSv1.2 If the directive does not exist or exists but does not contain "ALL -SSLv2 -SSLv3", this is a finding.
Fix: F-98569r1_fix
Ensure the "SSLProtocol" is added and looks like the following in the <'INSTALL PATH'>\conf\httpd.conf file: SSLProtocol -ALL +TLSv1.2 Restart the Apache service.
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- AS24-W1-000065
- Vuln IDs
-
- V-92337
- Rule IDs
-
- SV-102425r1_rule
Checks: C-91633r1_chk
Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # httpd -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Search for the directive "CustomLog" in the "httpd.conf" file: # cat /<path_to_file>/httpd.conf | grep -i "CustomLog" If the "CustomLog" directive is missing or does not look like the following, this is a finding: CustomLog "Logs/access_log" common
Fix: F-98575r1_fix
Edit the httpd.conf file and enter the name, path and level for the CustomLog.
- RMF Control
- AU-12
- Severity
- M
- CCI
- CCI-000169
- Version
- AS24-W1-000070
- Vuln IDs
-
- V-92339
- Rule IDs
-
- SV-102427r1_rule
Checks: C-91635r1_chk
In a command line, navigate to "<'INSTALLED PATH'>\bin". Run "httpd -M" to view a list of installed modules. If the "log_config_module" is not enabled, this is a finding.
Fix: F-98577r1_fix
Uncomment the "log_config_module" module line in the <'INSTALL PATH'>\conf\httpd.conf file. Restart the Apache service.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000130
- Version
- AS24-W1-000090
- Vuln IDs
-
- V-92343
- Rule IDs
-
- SV-102431r1_rule
Checks: C-91639r1_chk
Items to be logged are as shown in this sample line in the <'INSTALL PATH'>\conf\httpd.conf file: LogFormat "%a %A %h %H %l %m %s %t %u %U \"%{Referer}i\" " combined If the web server is not configured to capture the required audit events for all sites and virtual directories, this is a finding.
Fix: F-98581r1_fix
Configure the "LogFormat" in the "httpd.conf" file to look like the following: LogFormat "%a %A %h %H %l %m %s %t %u %U \"%{Referer}i\" " combined Restart the Apache service. NOTE: Your log format may be using different variables based on your environment, however, it should be verified to be producing the same end result of logged elements.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-000133
- Version
- AS24-W1-000130
- Vuln IDs
-
- V-92351
- Rule IDs
-
- SV-102439r1_rule
Checks: C-91647r1_chk
Interview the System Administrator to review the configuration of the Apache web server architecture and determine if inbound web traffic is passed through a proxy. If the Apache web server is receiving inbound web traffic through a proxy, the audit logs must be reviewed to determine if correct source information is being passed through by the proxy server. View Apache log files as configured in "httpd.conf" files. When the log file is displayed, review source IP information in log entries and verify the entries do not reflect the IP address of the proxy server. If the log entries in the log file(s) reflect the IP address of the proxy server as the source, this is a finding.
Fix: F-98589r1_fix
Access the proxy server through which inbound web traffic is passed and configure settings to pass web traffic to the Apache web server transparently.
- RMF Control
- AU-5
- Severity
- M
- CCI
- CCI-000139
- Version
- AS24-W1-000160
- Vuln IDs
-
- V-92357
- Rule IDs
-
- SV-102445r1_rule
Checks: C-91653r1_chk
Work with the SIEM administrator to determine if an alert is configured when audit data is no longer received as expected. If there is no alert configured, this is a finding.
Fix: F-98595r1_fix
Work with the SIEM administrator to configure an alert when no audit data is received from Apache based on the defined schedule of connections.
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-000162
- Version
- AS24-W1-000180
- Vuln IDs
-
- V-92359
- Rule IDs
-
- SV-102447r1_rule
Checks: C-91655r1_chk
Review the <'INSTALL PATH'>\conf\httpd.conf file to determine the location of the logs. Determine permissions for log files. From the command line, navigate to the directory where the log files are located and enter the following command: icacls <'Apache Directory'>\logs\* ex: icacls c:\Apache24\logs\* Only the Auditors, Web Managers, Administrators, and the account that runs the web server should have permissions to the files. If any users other than those authorized have read access to the log files, this is a finding.
Fix: F-98597r1_fix
To maintain the integrity of the data that is being captured in the log files, ensure that only the members of the Auditors group, Administrators, and the user assigned to run the web server software are granted permissions to read the log files.
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-000163
- Version
- AS24-W1-000200
- Vuln IDs
-
- V-92363
- Rule IDs
-
- SV-102451r1_rule
Checks: C-91659r1_chk
Query the System Administrator (SA) to determine who has update access to the web server log files. The role of auditor and the role of SA should be distinctly separate. An individual functioning as an auditor should not also serve as an SA due to a conflict of interest. Only management-authorized individuals with a privileged ID or group ID associated with an auditor role will have access permission to log files that are greater than read on web servers he or she has been authorized to audit. Only management-authorized individuals with a privileged ID or group ID associated with either an SA or Web Administrator role may have read authority to log files for the web servers he or she has been authorized to administer. If an account with roles other than auditor has greater than read authority to the log files, this is a finding. Obtain the log location by reviewing the <'INSTALL PATH'>\conf\httpd.conf file. Click the "Browse" button and navigate to the directory where the log files are stored. Right-click the log file name to review and click "Properties". Click the "Security" tab. If an account associated with roles other than auditors, SAs, or Web Administrators has any access to log files, this is a finding. If an account with roles other than auditor has greater than read authority to the log files, this is a finding. This check does not apply to service account IDs used by automated services necessary to process, manage, and store log files.
Fix: F-98601r1_fix
Obtain the log location by reviewing the <'INSTALL PATH'>\conf\httpd.conf file. Click the "Browse" button and navigate to the directory where the log files are stored. Right-click the log file name to review and click "Properties". Click the "Security" tab. Set the log file permissions for the appropriate group(s). Click "OK". Select "Apply" in the "Actions" pane.
- RMF Control
- AU-9
- Severity
- M
- CCI
- CCI-001348
- Version
- AS24-W1-000210
- Vuln IDs
-
- V-92365
- Rule IDs
-
- SV-102453r1_rule
Checks: C-91661r1_chk
Interview the Information System Security Officer (ISSO), System Administrator (SA), Web Manager, Webmaster, or developers as necessary to determine whether a tested and verifiable backup strategy has been implemented for web server software as well as all web server data files. Proposed Questions: Who maintains the backup and recovery procedures? Do you have a copy of the backup and recovery procedures? Where is the off-site backup location? Is the contingency plan documented? When was the last time the contingency plan was tested? Are the test dates and results documented? If there is not a backup and recovery process for the web server, this is a finding.
Fix: F-98603r1_fix
Document the web server backup procedures.
- RMF Control
- CM-5
- Severity
- M
- CCI
- CCI-001749
- Version
- AS24-W1-000230
- Vuln IDs
-
- V-92367
- Rule IDs
-
- SV-102455r1_rule
Checks: C-91663r1_chk
Open the <'INSTALL PATH'>\conf\httpd.conf file. Review the list of loaded modules. If any of the loaded modules are unsigned, this is a finding.
Fix: F-98605r1_fix
Remove any unsigned modules.
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- AS24-W1-000240
- Vuln IDs
-
- V-92369
- Rule IDs
-
- SV-102457r1_rule
Checks: C-91665r1_chk
Interview the System Administrator (SA) about the role of the Apache web server. If the web server is hosting an application, have the SA provide supporting documentation on how the application's user management is accomplished outside of the web server. If the web server is not hosting an application, this is Not Applicable. If the web server is performing user management for hosted applications, this is a finding. If the web server is hosting an application and the SA cannot provide supporting documentation on how the application's user management is accomplished outside of the Apache web server, this is a finding.
Fix: F-98607r1_fix
Reconfigure any hosted applications on the Apache web server to perform user management outside the web server. Document how the hosted application user management is accomplished.
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- AS24-W1-000250
- Vuln IDs
-
- V-92371
- Rule IDs
-
- SV-102459r1_rule
Checks: C-91667r1_chk
Verify the document root directory and the configuration files do not provide for default index.html or welcome page. Verify the Apache User Manual content is not installed by checking the configuration files for manual location directives. Verify the Apache configuration files do not have the Server Status handler configured. Verify that the Server Information handler is not configured. Verify that any other handler configurations such as perl-status is not enabled. If any of these are present, this is a finding.
Fix: F-98609r1_fix
Review all pre-installed content and remove content that is not required. In particular, look for the unnecessary content that may be found in the document root directory, a configuration directory such as conf/extra directory, or as a UNIX/Linux package Remove the default index.html or welcome page if it is a separate package. If the default welcome page is part of the main Apache httpd package as it is on Red Hat Linux, comment out the configuration as shown below. Removing a file such as the "welcome.conf" is not recommended as it may be replaced if the package is updated. # # This configuration file enables the default "Welcome" # page if there is no default index page present for # the root URL. To disable the Welcome page, comment # out all the lines below. # ##<LocationMatch "^/+$"> ## Options -Indexes ## ErrorDocument 403 /error/noindex.html ##</LocationMatch> Remove the Apache User Manual content or comment out configurations referencing the manual: # yum erase httpd-manual Remove or comment out any Server Status handler configuration: # # Allow server status reports generated by mod_status, # with the URL of http://servername/server-status # Change the ".example.com" to match your domain to enable. # ##<Location /server-status> ## SetHandler server-status ## Order deny,allow ## Deny from all ## Allow from .example.com ##</Location> Remove or comment out any Server Information handler configuration: # # Allow remote server configuration reports, with the URL of # http://servername/server-info (requires that mod_info.c be loaded). # Change the ".example.com" to match your domain to enable. # ##<Location /server-info> ## SetHandler server-info ## Order deny,allow ## Deny from all ## Allow from .example.com ##</Location> Remove or comment out any other handler configuration such as perl-status: # This will allow remote server configuration reports, with the URL of # http://servername/perl-status # Change the ".example.com" to match your domain to enable. # ##<Location /perl-status> ## SetHandler perl-script ## PerlResponseHandler Apache2::Status ## Order deny,allow ## Deny from all ## Allow from .example.com ##</Location> The default source build provides extra content available in the /usr/local/apache2/conf/extra/ directory, but the configuration of most of the extra content is commented out by default. In particular, the inclusion of conf/extra/proxyhtml.conf is not commented out in "httpd.conf": # Server-pool management (MPM specific) #Include conf/extra/httpd-mpm.conf # Multi-language error messages #Include conf/extra/httpd-multilang-errordoc.conf # Fancy directory listings #Include conf/extra/httpd-autoindex.conf # Language settings #Include conf/extra/httpd-languages.conf # User home directories #Include conf/extra/httpd-userdir.conf # Real-time info on requests and configuration #Include conf/extra/httpd-info.conf # Virtual hosts #Include conf/extra/httpd-vhosts.conf # Local access to the Apache HTTP Server Manual #Include conf/extra/httpd-manual.conf # Distributed authoring and versioning (WebDAV) #Include conf/extra/httpd-dav.conf # Various default settings #Include conf/extra/httpd-default.conf # Configure mod_proxy_html to understand HTML4/XHTML1 <IfModule proxy_html_module> Include conf/extra/proxy-html.conf </IfModule> # Secure (SSL/TLS) connections #Include conf/extra/httpd-ssl.conf For applications developed in-house, ensure that development artifacts (sample data and scripts; unused libraries, components, debug code; or tools) are not included in the deployed software or accessible in the production environment.
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- AS24-W1-000260
- Vuln IDs
-
- V-92373
- Rule IDs
-
- SV-102461r1_rule
Checks: C-91669r1_chk
In a command line, CD to "<'INSTALLED PATH'>\bin". Run "httpd -M" to view a list of installed modules. If any of the following modules are present, this is a finding: proxy_module proxy_ajp_module proxy_balancer_module proxy_ftp_module proxy_http_module proxy_connect_module
Fix: F-98611r1_fix
Edit the <'INSTALL PATH'>\conf\httpd.conf file and remove the following modules: proxy_module proxy_ajp_module proxy_balancer_module proxy_ftp_module proxy_http_module proxy_connect_module
- RMF Control
- CM-7
- Severity
- H
- CCI
- CCI-000381
- Version
- AS24-W1-000270
- Vuln IDs
-
- V-92375
- Rule IDs
-
- SV-102463r1_rule
Checks: C-91671r1_chk
If the site requires the use of a particular piece of software, the Information System Security Officer (ISSO) will need to maintain documentation identifying this software as necessary for operations. The software must be operated at the vendor's current patch level and must be a supported vendor release. If programs or utilities that meet the above criteria are installed on the web server, and appropriate documentation and signatures are in evidence, this is not a finding. Determine whether the web server is configured with unnecessary software. Determine whether processes other than those that support the web server are loaded and/or run on the web server. Examples of software that should not be on the web server are all web development tools, office suites (unless the web server is a private web development server), compilers, and other utilities that are not part of the web server suite or the basic operating system. Check the directory structure of the server and verify that additional, unintended, or unneeded applications are not loaded on the system. If, after review of the application on the system, there is no justification for the identified software, this is a finding.
Fix: F-98613r1_fix
Remove any unnecessary applications.
- RMF Control
- CM-7
- Severity
- H
- CCI
- CCI-000381
- Version
- AS24-W1-000280
- Vuln IDs
-
- V-92377
- Rule IDs
-
- SV-102465r1_rule
Checks: C-91673r1_chk
Obtain a list of the user accounts for the system, noting the privileges for each account. Verify with the System Administrator (SA) or the Information System Security Officer (ISSO) that all privileged accounts are mission essential and documented. Verify with the SA or the ISSO that all non-administrator access to shell scripts and operating system functions are mission essential and documented. If undocumented privileged accounts are present, this is a finding. If undocumented access to shell scripts or operating system functions is present, this is a finding.
Fix: F-98615r1_fix
Ensure non-administrators are not allowed access to the directory tree, the shell, or other operating system functions and utilities.
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- AS24-W1-000300
- Vuln IDs
-
- V-92381
- Rule IDs
-
- SV-102469r1_rule
Checks: C-91677r1_chk
Review the <'INSTALL PATH'>\conf\httpd.conf file. If "Action" or "AddHandler" exist and they configure .exe, .dll, .com, .bat, or .csh, or any other shell as a viewer for documents, this is a finding.
Fix: F-98619r1_fix
Disable MIME types for .exe, .dll, .com, .bat, and .csh programs. If "Action" or "AddHandler" exist and they configure .exe, .dll, .com, .bat, or .csh, remove those references. Restart the Apache service.
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- AS24-W1-000310
- Vuln IDs
-
- V-92383
- Rule IDs
-
- SV-102471r1_rule
Checks: C-91679r1_chk
Review the <'INSTALL PATH'>\conf\httpd.conf file. Locate cgi-bin files and directories enabled in the "Script", "ScriptAlias" or "ScriptAliasMatch", or "ScriptInterpreterSource" directives. If any script is not needed for application operation, this is a finding.
Fix: F-98621r1_fix
Remove any scripts in cgi-bin directory if they are not needed for application operation.
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000381
- Version
- AS24-W1-000330
- Vuln IDs
-
- V-92387
- Rule IDs
-
- SV-102475r1_rule
Checks: C-91683r1_chk
In a command line, navigate to "<'INSTALLED PATH'>\bin". Run "httpd -M" to view a list of installed modules. If any of the following modules are present, this is a finding: dav_module dav_fs_module dav_lock_module
Fix: F-98625r1_fix
Edit the <'INSTALL PATH'>\conf\httpd.conf file and remove the following modules: dav_module dav_fs_module dav_lock_module Restart the Apache service.
- RMF Control
- CM-7
- Severity
- M
- CCI
- CCI-000382
- Version
- AS24-W1-000360
- Vuln IDs
-
- V-92389
- Rule IDs
-
- SV-102477r1_rule
Checks: C-91685r1_chk
Review the <'INSTALL PATH'>\conf\httpd.conf file and search for the following directive: Listen For any enabled "Listen" directives, verify they specify both an IP address and port number. If the "Listen" directive is found with only an IP address or only a port number specified, this is finding. If the IP address is all zeros (i.e., 0.0.0.0:80 or [::ffff:0.0.0.0]:80), this is a finding. If the "Listen" directive does not exist, this is a finding.
Fix: F-98627r1_fix
Edit the <'INSTALL PATH'>\conf\httpd.conf file and set the "Listen" directive to listen on a specific IP address and port. Restart the Apache service.
- RMF Control
- IA-5
- Severity
- M
- CCI
- CCI-000197
- Version
- AS24-W1-000370
- Vuln IDs
-
- V-92391
- Rule IDs
-
- SV-102479r1_rule
Checks: C-91687r1_chk
Review the <'INSTALL PATH'>\conf\httpd.conf file. Ensure SSL is enabled by looking at the "SSLVerifyClient" directive. If the value of "SSLVerifyClient" is not set to "require", this is a finding.
Fix: F-98629r1_fix
Edit the <'INSTALL PATH'>\conf\httpd.conf file and set the value of "SSLVerifyClient" to "require". Restart the Apache service.
- RMF Control
- IA-5
- Severity
- M
- CCI
- CCI-000185
- Version
- AS24-W1-000380
- Vuln IDs
-
- V-92393
- Rule IDs
-
- SV-102481r1_rule
Checks: C-91689r1_chk
Review the <'INSTALL PATH'>/conf/extra/httpd-ssl.conf file. Look for the "SSLCACertificateFile" directive. Review the path of the "SSLCACertificateFile" directive. Review the contents of <'path of cert'>\ca-bundle.crt. Examine the contents of this file to determine if the trusted CAs are DoD approved. If the trusted CA that is used to authenticate users to the website does not lead to an approved DoD CA, this is a finding. NOTE: There are non-DoD roots that must be on the server for it to function. Some applications, such as antivirus programs, require root CAs to function. DoD-approved certificate can include the External Certificate Authorities (ECA), if approved by the AO. The PKE InstallRoot 3.06 System Administrator Guide (SAG), dated 08 Jul 2008, contains a complete list of DoD, ECA, and IECA CAs.
Fix: F-98631r1_fix
Configure the web server's trust store to trust only DoD-approved PKIs (e.g., DoD PKI, DoD ECA, and DoD-approved external partners). Restart the Apache service.
- RMF Control
- SC-2
- Severity
- M
- CCI
- CCI-001082
- Version
- AS24-W1-000430
- Vuln IDs
-
- V-92399
- Rule IDs
-
- SV-102487r1_rule
Checks: C-91695r1_chk
Review the web server documentation and configuration to determine what web server accounts are available on the hosting server. Review permissions in the web and Apache directories. If the files are owned by anyone other than the Apache user set up to run Apache, this is a finding. If non-privileged web server accounts are available with access to functions, directories, or files not needed for the role of the account, this is a finding.
Fix: F-98637r1_fix
Limit the functions, directories, and files that are accessible by each account and role to administrative accounts and remove or modify non-privileged account access.
- RMF Control
- SC-2
- Severity
- M
- CCI
- CCI-001082
- Version
- AS24-W1-000450
- Vuln IDs
-
- V-92403
- Rule IDs
-
- SV-102491r1_rule
Checks: C-91699r1_chk
Review the web server documentation and deployed configuration to determine whether hosted application functionality is separated from web server management functions. If the functions are not separated, this is a finding.
Fix: F-98641r1_fix
Configure Apache to separate the hosted applications from web server management functionality.
- RMF Control
- SC-23
- Severity
- M
- CCI
- CCI-001185
- Version
- AS24-W1-000460
- Vuln IDs
-
- V-92405
- Rule IDs
-
- SV-102493r1_rule
Checks: C-91701r1_chk
Review the <'INSTALL PATH'>\conf\httpd.conf file. Search for the following directive: SessionMaxAge Verify the value of "SessionMaxAge" is set to "600" or less. If "SessionMaxAge" does not exist or is set to more than "600", this is a finding.
Fix: F-98643r1_fix
Open the <'INSTALL PATH'>\conf\httpd.conf file. Set the "SessionMaxAge" directive to a value of "600" or greater; add the directive if it does not exist. Restart the Apache service.
- RMF Control
- SC-23
- Severity
- M
- CCI
- CCI-001664
- Version
- AS24-W1-000470
- Vuln IDs
-
- V-92407
- Rule IDs
-
- SV-102495r1_rule
Checks: C-91703r1_chk
Review the <'INSTALL PATH'>\conf\httpd.conf file. If "HttpOnly;secure" is not configured, this is a finding. Review the code. If when creating cookies, the following is not occurring, this is a finding: function setCookie() { document.cookie = "ALEPH_SESSION_ID = $SESS; path = /; secure"; }
Fix: F-98645r1_fix
Add this line to "httpd.conf" file: Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;secure Add the secure attribute to the JavaScript set cookie: function setCookie() { document.cookie = "ALEPH_SESSION_ID = $SESS; path = /; secure"; } HttpOnly cannot be used since by definition this is a cookie set by JavaScript. Restart the Apache service.
- RMF Control
- SC-23
- Severity
- M
- CCI
- CCI-001188
- Version
- AS24-W1-000480
- Vuln IDs
-
- V-92409
- Rule IDs
-
- SV-102497r1_rule
Checks: C-91705r1_chk
Review the <'INSTALL PATH'>\conf\httpd.conf file. Verify the "mod_unique_id" is loaded. If it does not exist, this is a finding.
Fix: F-98647r1_fix
Edit the <'INSTALL PATH'>\conf\httpd.conf file and load the "mod_unique_id" module. Restart the Apache service.
- RMF Control
- SC-23
- Severity
- M
- CCI
- CCI-001188
- Version
- AS24-W1-000500
- Vuln IDs
-
- V-92413
- Rule IDs
-
- SV-102501r1_rule
Checks: C-91711r1_chk
Review the <'INSTALL PATH'>\conf\httpd.conf file. Check to see if the "mod_unique_id" is loaded. If it does not exist, this is a finding.
Fix: F-98653r1_fix
Edit the <'INSTALL PATH'>\conf\httpd.conf file and load the "mod_unique_id" module. Restart the Apache service.
- RMF Control
- SC-23
- Severity
- M
- CCI
- CCI-001188
- Version
- AS24-W1-000530
- Vuln IDs
-
- V-92419
- Rule IDs
-
- SV-102507r1_rule
Checks: C-91717r1_chk
Review the <'INSTALLED PATH'>\conf\httpd.conf file. Verify the "ssl_module" is loaded. If it does not exist, this is a finding. If the "SSLRandomSeed" directive is missing or does not look like the following, this is a finding: SSLRandomSeed startup builtin SSLRandomSeed connect builtin
Fix: F-98659r1_fix
Edit the <'INSTALLED PATH'>\conf\httpd.conf file and load the "ssl_module" module. Set the "SSLRandomSeed" directives to the following: SSLRandomSeed startup builtin SSLRandomSeed connect builtin Restart the Apache service.
- RMF Control
- SC-24
- Severity
- M
- CCI
- CCI-001190
- Version
- AS24-W1-000550
- Vuln IDs
-
- V-92423
- Rule IDs
-
- SV-102511r1_rule
Checks: C-91721r1_chk
Interview the System Administrator for the Apache 2.4 web server. Ask for documentation on the disaster recovery methods tested and planned for the Apache 2.4 web server in the event of the necessity for rollback. If documentation for a disaster recovery has not been established, this is a finding.
Fix: F-98663r1_fix
Prepare documentation for disaster recovery methods for the Apache 2.4 web server in the event of the necessity for rollback. Document and test the disaster recovery methods designed.
- RMF Control
- SC-3
- Severity
- M
- CCI
- CCI-001084
- Version
- AS24-W1-000580
- Vuln IDs
-
- V-92425
- Rule IDs
-
- SV-102513r1_rule
Checks: C-91723r1_chk
Determine whether the public web server has a two-way trusted relationship with any private asset located within the network. Private web server resources (e.g., drives, folders, printers, etc.) will not be directly mapped to or shared with public web servers. If sharing is selected for any web folder, this is a finding. If private resources (e.g., drives, partitions, folders/directories, printers, etc.) are shared with the public web server, this is a finding.
Fix: F-98665r1_fix
Configure the public web server to not have a trusted relationship with any system resource that is also not accessible to the public. Web content is not to be shared via Microsoft shares or NFS mounts.
- RMF Control
- SC-5
- Severity
- M
- CCI
- CCI-001094
- Version
- AS24-W1-000590
- Vuln IDs
-
- V-92427
- Rule IDs
-
- SV-102515r1_rule
Checks: C-91725r1_chk
Review the <'INSTALLED PATH'>\conf\httpd.conf file. Verify the "Timeout" directive is specified in the "httpd.conf" file to have a value of "10" seconds or less. If the "Timeout" directive is not configured or set for more than "10" seconds, this is a finding.
Fix: F-98667r1_fix
Review the <'INSTALLED PATH'>\conf\httpd.conf file. Add or modify the "Timeout" directive in the Apache configuration to have a value of "10" seconds or less. "Timeout 10" Restart the Apache service.
- RMF Control
- SI-11
- Severity
- M
- CCI
- CCI-001312
- Version
- AS24-W1-000620
- Vuln IDs
-
- V-92429
- Rule IDs
-
- SV-102517r1_rule
Checks: C-91729r1_chk
Review the <'INSTALL PATH'>\conf\httpd.conf file. If the "ErrorDocument" directive is not being used, this is a finding.
Fix: F-98669r1_fix
Edit the <'INSTALL PATH'>\conf\httpd.conf file and use the "ErrorDocument" directive to enable custom error pages. ErrorDocument 500 "Sorry, our script crashed. Oh dear" ErrorDocument 500 /cgi-bin/crash-recover ErrorDocument 500 http://error.example.com/server_error.html ErrorDocument 404 /errors/not_found.html ErrorDocument 401 /subscription/how_to_subscribe.html The syntax of the ErrorDocument directive is: ErrorDocument <3-digit-code> <action> Restart the Apache service. Additional Information: https://httpd.apache.org/docs/2.4/custom-error.html
- RMF Control
- SI-11
- Severity
- M
- CCI
- CCI-001312
- Version
- AS24-W1-000630
- Vuln IDs
-
- V-92431
- Rule IDs
-
- SV-102519r1_rule
Checks: C-91731r1_chk
Review the <'INSTALL PATH'>\conf\httpd.conf file. For any enabled "TraceEnable" directives, verify they are part of the server=level configuration (i.e., not nested in a "Directory" or "Location" directive). Also verify the "TraceEnable" directive is set to "Off". If the "TraceEnable directive is not part of the server-level configuration and/or is not set to "Off", this is a finding. If the directive does not exist in the conf file, this is a finding because the default value is "On".
Fix: F-98671r1_fix
Edit the <'INSTALL PATH'>\conf\httpd.conf file and add or set the value of "TraceEnable" to "Off". Restart the Apache service.
- RMF Control
- AC-12
- Severity
- M
- CCI
- CCI-002361
- Version
- AS24-W1-000640
- Vuln IDs
-
- V-92433
- Rule IDs
-
- SV-102521r1_rule
Checks: C-91733r1_chk
Review the <'INSTALL PATH'>\conf\httpd.conf file. Verify the "SessionMaxAge" directive exists. If it does not exist, this is a finding. If the "SessionMaxAge" directive exists but is not set to "1", this is a finding.
Fix: F-98673r1_fix
Edit the <'INSTALL PATH'>\conf\httpd.conf file and add or set the "SessionMaxAge" directive to "1". Restart the Apache service.
- RMF Control
- AC-12
- Severity
- M
- CCI
- CCI-002361
- Version
- AS24-W1-000650
- Vuln IDs
-
- V-92435
- Rule IDs
-
- SV-102523r1_rule
Checks: C-91735r1_chk
Review the <'INSTALL PATH'>\conf\httpd.conf file. Verify the "mod_reqtimeout" is loaded. If it does not exist, this is a finding. If the "mod_reqtimeout" module is loaded and the "RequestReadTimeout" directive is not configured, this is a finding.
Fix: F-98675r1_fix
Edit the <'INSTALL PATH'>\conf\httpd.conf file and load the "mod_reqtimeout" module. Set the "RequestReadTimeout" directive. Restart the Apache service.
- RMF Control
- AC-17
- Severity
- M
- CCI
- CCI-002314
- Version
- AS24-W1-000670
- Vuln IDs
-
- V-92439
- Rule IDs
-
- SV-102527r1_rule
Checks: C-91739r1_chk
Review the <'INSTALL PATH'>\conf\httpd.conf file. If "IP Address Restrictions" are not configured or IP ranges configured to be "Allow" are not restrictive enough to prevent connections from nonsecure zones, this is a finding.
Fix: F-98679r1_fix
Configure the "http.conf" file to include restrictions. Example: <RequireAll> Require not host phishers.example.com moreidiots.example </RequireAll> Restart the Apache service.
- RMF Control
- AC-17
- Severity
- M
- CCI
- CCI-002322
- Version
- AS24-W1-000680
- Vuln IDs
-
- V-92441
- Rule IDs
-
- SV-102529r1_rule
Checks: C-91741r1_chk
Interview the System Administrator and Web Manager. Ask for documentation for the Apache web server administration. Verify there are documented procedures for shutting down an Apache website in the event of an attack. The procedure should, at a minimum, provide the following steps: Determine the respective website for the application at risk of an attack. Stop the Apache service. If the web server is not capable of or cannot be configured to disconnect or disable remote access to the hosted applications when necessary, this is a finding.
Fix: F-98681r1_fix
Prepare documented procedures for shutting down an Apache website in the event of an attack. The procedure should, at a minimum, provide the following step: Stop the Apache service.
- RMF Control
- AC-6
- Severity
- M
- CCI
- CCI-002235
- Version
- AS24-W1-000690
- Vuln IDs
-
- V-92443
- Rule IDs
-
- SV-102531r1_rule
Checks: C-91743r1_chk
Determine which tool or control file is used to control the configuration of the web server. If the control of the web server is done via control files, verify who has update access to them. If tools are being used to configure the web server, determine who has access to execute the tools. If accounts other than the System Administrator (SA), the Web Manager, or the Web Manager designees have access to the web administration tool or control files, this is a finding.
Fix: F-98683r1_fix
Restrict access to the web administration tool to only the System Administrator, Web Manager, or the Web Manager designees.
- RMF Control
- AU-3
- Severity
- M
- CCI
- CCI-001844
- Version
- AS24-W1-000700
- Vuln IDs
-
- V-92445
- Rule IDs
-
- SV-102533r1_rule
Checks: C-91745r1_chk
Review the <'INSTALL PATH'>\conf\httpd.conf file. Verify the "mod_proxy" is loaded. If it does not exist, this is a finding. If the "mod_proxy" module is loaded and the "ProxyPass" directive is not configured, this is a finding.
Fix: F-98685r1_fix
Edit the <'INSTALL PATH'>\conf\httpd.conf file and load the "mod_proxy" module. Set the "ProxyPass" directive. Restart the Apache service.
- RMF Control
- AU-4
- Severity
- M
- CCI
- CCI-001849
- Version
- AS24-W1-000710
- Vuln IDs
-
- V-92447
- Rule IDs
-
- SV-102535r1_rule
Checks: C-91747r1_chk
Work with SIEM administrator to determine log storage capacity. If there is no setting within a SIEM to accommodate enough a large logging capacity, this is a finding.
Fix: F-98687r1_fix
Work with the SIEM administrator to determine if the SIEM is configured to allocate log record storage capacity large enough to accommodate the logging requirements of the Apache web server.
- RMF Control
- AU-4
- Severity
- M
- CCI
- CCI-001851
- Version
- AS24-W1-000720
- Vuln IDs
-
- V-92449
- Rule IDs
-
- SV-102537r1_rule
Checks: C-91749r1_chk
Work with the SIEM administrator to determine current security integrations. If the SIEM is not integrated with security, this is a finding.
Fix: F-98689r1_fix
Work with the SIEM administrator to integrate with an organizations security infrastructure.
- RMF Control
- AU-4
- Severity
- M
- CCI
- CCI-001851
- Version
- AS24-W1-000730
- Vuln IDs
-
- V-92451
- Rule IDs
-
- SV-102539r1_rule
Checks: C-91751r1_chk
Work with the SIEM administrator to determine current security integrations. If the SIEM is not integrated with security, this is a finding.
Fix: F-98691r1_fix
Work with the SIEM administrator to integrate with an organizations security infrastructure.
- RMF Control
- AU-5
- Severity
- M
- CCI
- CCI-001855
- Version
- AS24-W1-000740
- Vuln IDs
-
- V-92455
- Rule IDs
-
- SV-102543r1_rule
Checks: C-91755r1_chk
Work with the SIEM administrator to determine if an alert is configured when audit data is no longer received as expected. If there is no alert configured, this is a finding.
Fix: F-98695r1_fix
Work with the SIEM administrator to configure an alert when no audit data is received from Apache based on the defined schedule of connections.
- RMF Control
- SC-5
- Severity
- M
- CCI
- CCI-002385
- Version
- AS24-W1-000820
- Vuln IDs
-
- V-92463
- Rule IDs
-
- SV-102551r1_rule
Checks: C-91765r1_chk
Right-click <'Install Path'>\bin\httpd.exe. Click "Properties" from the "Context" menu. Select the "Security" tab. Review the groups and user names. The following account may have Full control privileges: TrustedInstaller Web Managers Web Manager designees The following accounts may have read and execute, or read permissions: Non Web Manager Administrators ALL APPLICATION PACKAGES (built-in security group) SYSTEM Users Specific users may be granted read and execute and read permissions. Compare the local documentation authorizing specific users against the users observed when reviewing the groups and users. If any other access is observed, this is a finding.
Fix: F-98705r1_fix
Restrict access to the web administration tool to only the Web Manager and the Web Manager's designees.
- RMF Control
- SC-5
- Severity
- M
- CCI
- CCI-002385
- Version
- AS24-W1-000830
- Vuln IDs
-
- V-92465
- Rule IDs
-
- SV-102553r1_rule
Checks: C-91767r1_chk
Verify the "Timeout" directive is specified in the Apache configuration files to have a value of "10" seconds or less. If the "Timeout" directive is not configured or set for more than "10" seconds, this is a finding.
Fix: F-98707r1_fix
Add or modify the "Timeout" directive in the Apache configuration to have a value of "10" seconds or less. "Timeout 10" Restart the Apache service.
- RMF Control
- SC-8
- Severity
- M
- CCI
- CCI-002418
- Version
- AS24-W1-000860
- Vuln IDs
-
- V-92469
- Rule IDs
-
- SV-102557r1_rule
Checks: C-91771r1_chk
Search the Apache configuration files for the "SSLCompression" directive. If the "SSLCompression" directive does not exist, this is a not a finding. If the "SSLCompression" directive exists and is not set to "Off", this is a finding.
Fix: F-98711r1_fix
Perform the following to implement the recommended state: Search the Apache configuration files for the "SSLCompression" directive. If the directive is present, set it to "Off". Restart the Apache service.
- RMF Control
- SI-2
- Severity
- M
- CCI
- CCI-002605
- Version
- AS24-W1-000930
- Vuln IDs
-
- V-92475
- Rule IDs
-
- SV-102563r1_rule
Checks: C-91777r1_chk
Determine the most recent patch level of the Apache web server 2.4 software, as posted on the Apache HTTP Server Project website. In a command line, type "httpd -v". If the version is more than one version behind the most recent patch level, this is a finding.
Fix: F-98717r1_fix
Install the current version of the web server software and maintain appropriate service packs and patches.
- RMF Control
- CM-6
- Severity
- H
- CCI
- CCI-000366
- Version
- AS24-W1-000940
- Vuln IDs
-
- V-92477
- Rule IDs
-
- SV-102565r1_rule
Checks: C-91779r1_chk
Access "Apps" menu. Under "Administrative Tools", select "Computer Management". In left pane, expand "Local Users and Groups" and click on "Users". Review the local users listed in the middle pane. If any local accounts are present and are used by Apache Web Server, verify with System Administrator that default passwords have been changed. If passwords have not been changed from the default, this is a finding.
Fix: F-98719r1_fix
Access "Apps" menu. Under "Administrative Tools", select "Computer Management". In left pane, expand "Local Users and Groups" and click on "Users". Change passwords for any local accounts that are present and are used by Apache Web Server. Develop an internal process for changing passwords on a regular basis.
- RMF Control
- CM-6
- Severity
- L
- CCI
- CCI-000366
- Version
- AS24-W1-000950
- Vuln IDs
-
- V-92479
- Rule IDs
-
- SV-102567r1_rule
Checks: C-91781r1_chk
Review the website to determine if "HTTP" and "HTTPS" are used in accordance with well-known ports (e.g., 80 and 443) or those ports and services as registered and approved for use by the DoD Ports, Protocols, and Services Management (PPSM). Verify that any variation in PPS is documented, registered, and approved by the PPSM. If it is not, this is a finding.
Fix: F-98721r1_fix
Ensure the website enforces the use of IANA well-known ports for "HTTP" and "HTTPS".
- RMF Control
- CM-6
- Severity
- H
- CCI
- CCI-000366
- Version
- AS24-W1-000960
- Vuln IDs
-
- V-92481
- Rule IDs
-
- SV-102569r1_rule
Checks: C-91783r1_chk
Determine the version of the Apache software that is running on the system. In a command line, navigate to "<'INSTALLED PATH'>\bin". Run "httpd -v" to view the Apache version. If the version of Apache is not at the following version or higher, this is a finding: Apache 2.4 (February 2012)
Fix: F-98723r1_fix
Install the current version of the web server software and maintain appropriate service packs and patches.
- RMF Control
- SC-23
- Severity
- M
- CCI
- CCI-002470
- Version
- AS24-W1-000800
- Vuln IDs
-
- V-92845
- Rule IDs
-
- SV-102933r1_rule
Checks: C-92151r1_chk
Review the "ssl.conf" file. Look for the "SSLCACertificateFile" directive. Review the path of the "SSLCACertificateFile" directive. Review the contents of <'path of cert'>\ca-bundle.crt. Examine the contents of this file to determine if the trusted CAs are DoD approved. If the trusted CA that is used to authenticate users to the website does not lead to an approved DoD CA, this is a finding. NOTE: There are non-DoD roots that must be on the server for it to function. Some applications, such as antivirus programs, require root CAs to function. DoD-approved certificate can include the External Certificate Authorities (ECA), if approved by the AO. The PKE InstallRoot 3.06 System Administrator Guide (SAG), dated 08 Jul 2008, contains a complete list of DoD, ECA, and IECA CAs.
Fix: F-99089r1_fix
Configure the web server's trust store to trust only DoD-approved PKIs (e.g., DoD PKI, DoD ECA, and DoD-approved external partners).
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- AS24-W1-000970
- Vuln IDs
-
- V-94855
- Rule IDs
-
- SV-104685r1_rule
Checks: C-94051r1_chk
Work with the SIEM administrator to determine if an alert is configured when audit data is no longer received as expected. If there is no alert configured, this is a finding.
Fix: F-100979r1_fix
Work with the SIEM administrator to configure an alert when no audit data is received from Apache based on the defined schedule of connections.
- RMF Control
- AU-8
- Severity
- M
- CCI
- CCI-001890
- Version
- AS24-W1-000760
- Vuln IDs
-
- V-94857
- Rule IDs
-
- SV-104687r1_rule
Checks: C-94053r1_chk
Review the web server documentation and configuration to determine the time stamp format for log data. In a command line, navigate to "<'INSTALLED PATH'>\bin". Run "httpd -M" to view a list of installed modules. If "log_config_module" is not listed, this is a finding. In a command line, navigate to "<'INSTALLED PATH'>\bin". Determine the location of the "httpd.conf" file by running the following command: httpd -V Review the "HTTPD_ROOT" path. Navigate to the "HTTPD_ROOT"/conf directory. Edit the "httpd.conf" file. Verify the "LogFormat" directive exists. If it does not exist, this is a finding. Verify the "LogFormat" line contains the "%t" flag. If "%t" flag is not present, time is not mapped to UTC or GMT time, and this is a finding.
Fix: F-100981r1_fix
In a command line, navigate to "<'INSTALLED PATH'>\bin". Run "httpd -M" to view a list of installed modules. If "log_config_module" is not listed, enable this module. In a command line, navigate to "<'INSTALLED PATH'>\bin". Determine the location of the "httpd.conf" file by running the following command: httpd -V Review the "HTTPD_ROOT" path. Navigate to the "HTTPD_ROOT"/conf directory. Edit the "httpd.conf" file. Determine if the "LogFormat" directive exists. If it does not exist, ensure the "LogFormat" line contains the "%t" flag.