APACHE Server 2.0 for Unix

The APACHE Server 2.0 for Unix (V1 R5) has 55 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

55STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R5

CurrentPublished Fri Oct 23 2015

The URL-path name must be set to the file path name or the directory path name.

APACHE Server 2.0 for Unix

Assessment Title

Rule Text

The URL-path name must be set to the file path name or the directory path name.

Description

Discussion Text

The ScriptAlias directive controls which directories the Apache server "sees" as containing scripts. If the directive uses a URL-path name that is different than the actual file system path, the potential exists to expose the script source code.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-26327

Rule

SV-33229r1_rule

Severity

medium

Rule Version

WA00560 A22

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Enter the following command:

grep "ScriptAlias" /usr/local/apache2/conf/httpd.conf.  

If any enabled ScriptAlias directive do not have matching URL-path and file-path or directory-path entries, this is a finding.

Implementation Procedure

Fix Text

Edit the httpd.conf file and set the ScriptAlias URL-path and file-path or directory-path entries.

STIG check 48 of 55 in the APACHE Server 2.0 for Unix STIG checklist

← Previous · V-26326The web server must be configured to listen on a specific IP address and port.Next · V-26368 →Automatic directory indexing must be disabled.