Oracle HTTP Server 12.1.3 Security Technical Implementation Guide

The Oracle HTTP Server 12.1.3 Security Technical Implementation Guide (V2 R3) has 280 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

280STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R3

CurrentPublished Thu Jan 30 2025

OHS must have the LoadModule proxy_balancer_module directive disabled.

Oracle HTTP Server 12.1.3 Security Technical Implementation Guide

Assessment Title

Rule Text

OHS must have the LoadModule proxy_balancer_module directive disabled.

Description

Discussion Text

A web server should be primarily a web server or a proxy server but not both, for the same reasons that other multi-use servers are not recommended. Scanning for web servers that will also proxy requests into an otherwise protected network is a very common attack making the attack anonymous.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-221401

Rule

SV-221401r960963_rule

Severity

medium

Rule Version

OH12-1X-000154

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/httpd.conf with an editor.

2. Search for the "LoadModule proxy_balancer_module" directive at the OHS server configuration scope.

3. If the directive exists and is not commented out, this is a finding.

Implementation Procedure

Fix Text

1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/httpd.conf with an editor.

2. Search for the "LoadModule proxy_balancer_module" directive at the OHS server configuration scope.

3. Comment out the "LoadModule proxy_balancer_module" directive if it exists.

STIG check 129 of 280 in the Oracle HTTP Server 12.1.3 STIG checklist

← Previous · V-221400OHS must have the LoadModule proxy_connect_module directive disabled.Next · V-221402 →OHS must disable the directive pointing to the directory containing the OHS manuals.