What changed in Apache Server 2.4 UNIX Server STIG V3R3V3R3 changes

Check text

Verify the "ssl module" module is loaded: # httpd -M | grep -i ssl_module Output: ssl_module (shared) If the "ssl_module" is not found, this is a finding. Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # apachectl -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Note: The apachectl front end is the preferred method for locating the Apache httpd file. For some Linux distributions, "apache2ctl -V" or "httpd -V" can also be used. Search for the directive "SSLProtocol" in the "httpd.conf" file: # cat /&ltpath_to_file>/httpd.conf | grep -i "SSLProtocol" If the "SSLProtocol" directive is missing or does not look like the following, this is a finding: SSLProtocol -ALLSSLv2 -SSLv3 -TLSv1 +TLSv1.2 +TLSv1.3 If the TLSdirective versiondoes is not TLSexist, 1.2 or higher,exists accordingbut todoes NISTnot SPcontain 800"-52SSLv2 Rev-SSLv3 2, or if non-FIPS-approvedTLSv1 algorithms+TLSv1.2 are enabled+TLSv1.3", this is a finding.

Fix text

# cat /etc/httpd/conf.d/ssl.conf | grep "SSLProtocol - ALL +TLSv1.2" Ensure the "SSLProtocol" is added to the ssl.conf file and looks like the following: SSLProtocol -ALLSSLv2 -SSLv3 -TLSv1 +TLSv1.2 +TLSv1.3 Restart Apache: apachectl restart

Discussion

Data exchanged between the user and the Apache web server can range from static display data to credentials used to log on to the hosted application. Even when data appears to be static, the non-displayednondisplayed logic in a web page may expose business logic or trusted system relationships. The integrity of all the data being exchanged between the user and the Apache web server must always be trusted. To protect the integrity and trust, encryption methods should be used to protect the complete communication session. Satisfies: SRG-APP-000014-WSR-000006, SRG-APP-000015-WSR-000014, SRG-APP-000033-WSR-000169, SRG-APP-000172-WSR-000104, SRG-APP-000179-WSR-000110, SRG-APP-000179-WSR-000111, SRG-APP-000224-WSR-000139, SRG-APP-000427-WSR-000186, SRG-APP-000439-WSR-000151, SRG-APP-000439-WSR-000152, SRG-APP-000439-WSR-000153, SRG-APP-000442-WSR-000182

V-214230 in V3R3

Check text

Enter the following command: "httpd -M" This will provide a list of the loaded modules. Validate that all displayed modules are required for operationsoperation. If any module is not required for operation, this is a finding. Note: The following modules are needed for basic web function and do not need to be reviewed: core_module http_module so_module mpm_prefork_module For a complete list of signed Apache Modulesmodules, review https://httpd.apache.org/docs/2.4/mod/.

Fix text

Remove any unsigned modules.Remove any unsigned modules and any modules that are not required for operation.

V-214238 in V3R3

Title

The Apache web server must be protected from being stopped by a non-privileged user.

Check text

Review the web server documentation and deployed configuration to determine where the process ID is stored and which utilities are used to start/stop the web server. Locate the httpd.pid file and list its permission set and owner/group # find / -name "httpd.pid Output should be similar to: /run/httpd/httpd.pid  # ls -laH /run/httpd/httpd.pid Output should be similar -rw-r--r--. 1 root root 5 Jun 13 03:18 /run/httpd/httpd.pid If the file owner/group is not an administrative service account, this is a finding. If permission set is not 644 or more restrictive, this is a finding.   Verify the Apache service utilities (binaries) have the correct permission set and are user/group owned by an administrator account # ls -laH /usr/sbin/service Output should be similar: -rwxr-xr-x. 1 root root 3.2K Aug 19, 2019 /usr/sbin/service # ls -laH /usr/sbin/apachectl Output should be similar: -rwxr-xr-x. 1 root root 4.2K Oct 8, 2019 /usr/sbin/apachectl   If the service utilities owner/group is not an administrative service account, this is a finding.   If permission set is not 755 or more restrictive, this is a finding.

Discussion

An attacker has at least two reasons to stop a web server. The first is to cause a denial of service (DoS), and the second is to put in place changes the attacker made to the web server configuration. To prohibit an attacker from stopping the Apache web server, the process ID (pid) of the web server and the utilities used to start/stop it must be protected from access by non-privilegednonprivileged users. By knowing the "pid" and having access to the Apache web server utilities, a non-privilegednonprivileged user has a greater capability of stopping the server, whether intentionally or unintentionally.

V-214267 in V3R3

Check text

Locate the htpasswd file using the AuthUserFile directive by entering the following command: findcat /&ltpath_to_file>/httpd.conf | grep -namei htpasswd"AuthUserFile" | awk '{print $2}' NavigateIf tothe thatabove directory.command produces any output, run the "ls -l" command on it; for example: Run: ls -l /etc/httpd/.htpasswd Permissions should be: r-x r - x - - - (550) If permissions on "htpasswd"the password file are greater than "550", this is a finding. Verify the owner is the SA or Webweb Managermanager account. If another account has access to this file, this is a finding.

Fix text

Find the htpasswd file using the AuthUserFile directive: cat /&ltpath_to_file>/httpd.conf | grep -i "AuthUserFile" | awk '{print $2}' Ensure the SA or Webweb Managermanager account owns the "htpasswd" file. Ensure permissions are set to "550".

Discussion

In addition to OS restrictions, access rights to files and directories can be set on a website using the web server software. That is, in addition to allowing or denying all access rights, a rule can be specified that allows or denies partial access rights. For example, users can be given read-only access rights to files to view the information but not change the files. This check verifies that the htpasswd file is only accessible by Systemsystem Administratorsadministrators (SAs) or Webweb Managersmanagers, with the account running the web service having group permissions of read and execute. "htpasswd" is a utility used by Netscape and Apache to provide for password access to designated websites.

V-214274 in V3R3