What changed in Apache Server 2.4 Windows Server STIG V3R4V3R4 changes

Check text

In a command line, navigate to "&lt'INSTALLED PATH'>1bin". Run "httpd -M" to view a list of installed modules. If the "ssl_module" is not enabled, this is a finding. Review the &lt'INSTALL PATH'>1conf1httpd-ssl.conf file to determine if the "SSLProtocol" directive exists and looks like the following: SSLProtocol -ALLSSLv2 -SSLv3 -TLSv1 +TLSv1.2 -SSLv2 -SSLv3+TLSv1.3 If the directive does not exist, or exists but does not contain "-ALLSSLv2 -SSLv3 -TLSv1 +TLSv1.2 -SSLv2 -SSLv3+TLSv1.3", this is a finding.

Fix text

Ensure the "ssl_module" is loaded in the "httpd.conf" file (not commented out). Ensure the "SSLProtocol" is added and looks like the following in the &lt'INSTALL PATH'>1conf1httpd-ssl.conf file: SSLProtocol -ALLSSLv2 -SSLv3 -TLSv1 +TLSv1.2 +TLSv1.3 Restart the Apache service.

V-214308 in V3R4

Check text

Items to be logged are as shown in this sample line in the &lt'INSTALL PATH'>1conf1httpd.conf file: &ltIfModule log_config_module> LogFormat "%a %A %h %H %l %m %s %t %u %U 1"%{Referer}i1" " combined &lt/IfModule> If the web server is not configured to capture the required audit events for all sites and virtual directories, this is a finding.

Fix text

Configure the "LogFormat" in the "httpd.conf" file to look like the following: &ltIfModule log_config_module> LogFormat "%a %A %h %H %l %m %s %t %u %U 1"%{Referer}i1" " combined &lt/IfModule> Restart the Apache service. NOTE: YourThe log format may beuse using different variables based on your environment,; however, it should be verified tothat beit producingproduces the same end result of logged elements.

V-214311 in V3R4

Title

The Apache web server must only accept client DOD-apprformved and RFC 5280-compliant certification path validationes.

Check text

Review the &lt'INSTALLINSTALLED PATH'>/conf/extra/httpd1conf1extra1httpd-ssl.conf file to determine if the "SSLVerifyDepth" and "SSLCACertificateFile" directives exist. SSLVerifyDepth 1 If "SSLVerifyDepth" is set to "0", this is a finding. Look for the "SSLCACertificateFile" directive. Review the path of the "SSLCACertificateFile" directive. Review the contents of &lt'path of cert'>1ca-bundle.crt. Examine the contents of this file to determine if the trusted CAs are DoD DOD-approved. If the trusted CA that is used to authenticate users to the website does not lead to an approved DoDDOD CA, this is a finding. NOTE: There are non-DoDDOD roots that must be on the server for it to function. Some applications, such as antivirus programs, require root CAs to function. DoDDOD-approved certificatecertificates can include the External Certificate Authorities (ECA), if approved by the authorizing official (AO). The PKE InstallRoot 3.06 System Administrator Guide (SAG), dated 08 Jul 2008, contains a complete list of DoDDOD, ECA, and IECA CAs.

Fix text

Configure the web server's trust store to trust only DoDDOD-approved PKIs (e.g., DoDDOD PKI, DoDDOD ECA, and DoDDOD-approved external partners). Edit the &lt'INSTALLED PATH'>1conf1extra1httpd-ssl.conf file. Find the line "SSLVerifyDepth" and ensure it is set properly: SSLVerifyDepth 1 Restart the Apache service. "SSLVerifyDepth" is set based on the number of CAs that are required in the certificate chain to check before the client certificate is accepted as valid. A setting of "0" would allow self-signed CAs to validate client certificates, which is not desirable in this context. Additional Information: https://httpd.apache.org/docs/current/mod/mod_ssl.html

Discussion

A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate. Certification path validation includes checks such as certificate issuer trust, time validity, and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses. Non-DOD-approved PKIs have not been evaluated to ensure they have security controls and identity vetting procedures in place that are sufficient for DOD systems to rely on the identity asserted in the certificate. PKIs lacking sufficient security controls and identity vetting procedures risk being compromised and issuing certificates that enable adversaries to impersonate legitimate users. Satisfies: SRG-APP-000175-WSR-000095, SRG-APP-000427-WSR-000186

CCIs

CCI-000185CCI-000185,CCI-002470

V-214328 in V3R4

Discussion

Communication between a client and the web server is done using the HTTP protocol, but HTTP is a stateless protocol. To maintain a connection or session, a web server will generate a session identifier (ID) for each client session when the session is initiated. The session ID allows the web server to track a user session and, in many cases, the user, if the user previously logged on to a hosted application. When a web server accepts session identifiers that are not generated by the web server, theit web server creates an environment where session hijacking, such as session fixation, could be used to access hosted applications through session IDs that have already been authenticated. Forcing the web server to only accept web server-generated session IDs and to create new session IDs once a user is authenticated will limit session hijacking. Satisfies: SRG-APP-000223-WSR-000145, SRG-APP-000224-WSR-000135, SRG-APP-000224-WSR-000136, SRG-APP-000224-WSR-000137, SRG-APP-000224-WSR-000138

V-214333 in V3R4

Check text

Review the &lt'INSTALLED PATH'>1conf1httpd1conf1extra1httpd-ssl.conf file. Verify the "ssl_module" is loaded. If it does not exist, this is a finding. If the "SSLRandomSeed" directive is missing or does not look like the following, this is a finding: SSLRandomSeed startup builtin SSLRandomSeed connect builtin

V-214335 in V3R4

Check text

Review the &lt'INSTALLED PATH'>1conf1httpd.conf file. Verify the "Timeout" directive is specified in the "httpd.conf" file to have a value of "1060" seconds or less. If the "Timeout" directive is not configured or set for more than "1060" seconds, this is a finding.

Fix text

Review the &lt'INSTALLED PATH'>1conf1httpd.conf file. Add or modify the "Timeout" directive in the Apache configuration to have a value of "1060" seconds or less. "Timeout 1060" Restart the Apache service.

Discussion

Apache web server can limit the ability of the web server being used in a DoS attack through several methods. The methods employed will depend upon the hosted applications and their resource needs for proper operation. AnA exampleDoS settingcan occur when the Apache web server is so overwhelmed that couldit becan usedno tolonger limitrespond theto abilityadditional ofrequests. theA web server beingnot usedproperly intuned may become overwhelmed and cause a DoS attackcondition iseven bandwidthwith throttlingexpected traffic from users. To avoid a DoS, the Apache web server must be tuned to handle the expected traffic for the hosted applications. Satisfies: SRG-APP-000246-WSR-000149, SRG-APP-000435-WSR-000148

CCIs

CCI-001094CCI-001094,CCI-002385

V-214338 in V3R4

Discussion

Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after an absolute period of time, the user is forced to reauthenticate, guaranteeing the session is still in use. Enabling an absolute timeout for sessions closes sessions that are still active. Examples would be a runaway process accessing the Apache web server or an attacker using a hijacked session to slowly probe the Apache web server. Session IDs are tokens generated by web applications to uniquely identify an application user's session. Unique session IDs help to reduce predictability of said identifiers. When a user logs out, or when any other session termination event occurs, the web server must terminate the user session to minimize the potential for an attacker to hijack that particular user session. Satisfies: SRG-APP-000295-WSR-000012, SRG-APP-000220-WSR-000201

CCIs

CCI-002361CCI-002361,CCI-001185

V-214341 in V3R4