What changed in Apache Server 2.4 UNIX Site STIG V2R7V2R7 changes

Check text

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # apachectl -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Note: The apachectl front end is the preferred method for locating the Apache httpd file. For some Linux distributions, "apache2ctl -V" or "httpd -V" can also be used. Search for the "Set-Cookie Header" directive: # cat /&ltpath_to_file>/httpd.conf | grep -i "Header.*Set-Cookie" If "HttpOnly" "secure" is not configured, this is a finding. "Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;secure" Review the code. If, when creating cookies, the following is not occurring, this is a finding: function setCookie() { document.cookie = "ALEPH_SESSION_ID = $SESS; path = /; secure"; }

V-214288 in V2R7

Title

The Apache web server must beprohibit configuredor inrestrict accordance with the securityuse configurationof settingsnonsecure based on DoD security configuration or implementationunnecessary guidanceports, including STIGsprotocols, NSA configuration guidesmodules, CTOs, and/or DTMsservices.

Check text

Review the website to determine if HTTP and HTTPsHTTPS are used in accordance with well-known ports (e.g., 80 and 443) or those ports and services as registered and approved for use by the DoDDOD PPSM. Verify that any variation in PPS is documented, registered, and approved by the PPSM. If well-known ports and services are not approved for useduse by PPSM, this is a finding.

Discussion

ConfiguringWeb theservers Apacheprovide webnumerous serverprocesses, tofeatures, implementand organization-widefunctionalities securitythat implementationuse guidesTCP/IP andports. securitySome checklistsof guaranteesthese complianceprocesses withmay federalbe standardsdeemed andunnecessary establishesor too unsecure to run on a commonproduction securitysystem. The baselineweb acrossserver must provide the DoDcapability thatto reflectsdisable theor mostdeactivate restrictivenetwork-related securityservices posturethat consistentare withdeemed operationalnonessential requirements.to the Configurationserver settingsmission, are too unsecure, or are prohibited by the setPorts, ofProtocols, parametersand thatServices canManagement be(PPSM) changedCategory thatAssurance affectList (CAL) and vulnerability assessments. Configuring the web server to implement organizationwide security postureimplementation guides and/or functionalitysecurity ofchecklists theguarantees system.compliance Security-relatedwith parametersfederal arestandards parametersand impactingestablishes thea common security statebaseline ofacross the ApacheDOD webthat server,reflects including the parametersmost requiredrestrictive tosecurity satisfyposture otherconsistent securitywith controloperational requirements. Satisfies: SRG-APP-000516-WSR-000174, SRG-APP-000383-WSR-000175

CCIs

CCI-000366CCI-001762,CCI-000366

V-214304 in V2R7