[PATCH 01/18] Updated XCCDF and OVAL content for Apache Web Server. The commit includes an updated http.xml and for the added content creates the corresponding OVAL checks (where applicable). This worked is being tracked on ticket #37.

Willy Santos wsantos at redhat.com
Mon Apr 2 22:01:51 UTC 2012


---
 .../src/input/checks/httpd_serversignature_off.xml |   33 +++
 rhel6/src/input/checks/httpd_servertokens_prod.xml |   34 +++
 rhel6/src/input/checks/package_httpd_installed.xml |   25 +++
 rhel6/src/input/services/http.xml                  |  214 +++++++++++++++++++-
 4 files changed, 301 insertions(+), 5 deletions(-)
 create mode 100644 rhel6/src/input/checks/httpd_serversignature_off.xml
 create mode 100644 rhel6/src/input/checks/httpd_servertokens_prod.xml
 create mode 100644 rhel6/src/input/checks/package_httpd_installed.xml

diff --git a/rhel6/src/input/checks/httpd_serversignature_off.xml b/rhel6/src/input/checks/httpd_serversignature_off.xml
new file mode 100644
index 0000000..0731048
--- /dev/null
+++ b/rhel6/src/input/checks/httpd_serversignature_off.xml
@@ -0,0 +1,33 @@
+<def-group>
+  <definition class="compliance"
+  id="httpd_serversignature_off" version="1">
+    <metadata>
+      <title>Set ServerSignature directive to Off in Apache Web Server Configuration</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-3756-4" source="CCE" />
+      <description>Disable the display of server version number on error pages.</description>
+    </metadata>
+    <criteria comment="Apache Web Server is not being used or conditions are met"
+    operator="OR">
+      <extend_definition comment="httpd service is disabled"
+      definition_ref="service_httpd_disabled" />
+      <criterion comment="Conditions are satisfied"
+      test_ref="test_httpd_serversignature_off" />
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all"
+  check_existence="none_exist"
+  comment="Tests the value of the ServerSignature[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/httpd/conf/httpd.conf file"
+  id="test_httpd_serversignature_off" version="1">
+    <ind:object object_ref="obj_httpd_serversignature_off" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="obj_httpd_serversignature_off"
+  version="1">
+    <ind:path>/etc/httpd/conf</ind:path>
+    <ind:filename>httpd.conf</ind:filename>
+    <ind:pattern operation="pattern match">^[\s]*[Ss][Ee][Rr][Vv][Ee][Rr][Ss][Ii][Gg][Nn][Aa][Tt][Uu][Rr][Ee][\s]*Off</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/httpd_servertokens_prod.xml b/rhel6/src/input/checks/httpd_servertokens_prod.xml
new file mode 100644
index 0000000..84a124c
--- /dev/null
+++ b/rhel6/src/input/checks/httpd_servertokens_prod.xml
@@ -0,0 +1,34 @@
+<def-group>
+  <definition class="compliance"
+  id="httpd_servertokens_prod" version="1">
+    <metadata>
+      <title>Set ServerTokens directive to Prod in Apache Web Server Configuration</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-4474-3" source="CCE" />
+      <description>Information of web page headers should be restricted, to return only the word
+      Apache.</description>
+    </metadata>
+    <criteria comment="Apache Web Server is not being used or conditions are met"
+    operator="OR">
+      <extend_definition comment="httpd service is disabled"
+      definition_ref="service_httpd_disabled" />
+      <criterion comment="Conditions are satisfied"
+      test_ref="test_httpd_servertokens_prod" />
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all"
+  check_existence="none_exist"
+  comment="Tests the value of the ServerTokens[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/httpd/conf/httpd.conf file"
+  id="test_httpd_servertokens_prod" version="1">
+    <ind:object object_ref="obj_httpd_servertokens_prod" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="obj_httpd_servertokens_prod"
+  version="1">
+    <ind:path>/etc/httpd/conf</ind:path>
+    <ind:filename>httpd.conf</ind:filename>
+    <ind:pattern operation="pattern match">^[\s]*[Ss][Ee][Rr][Vv][Ee][Rr][Tt][Oo][Kk][Ee][Nn][Ss][\s]*Prod</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/package_httpd_installed.xml b/rhel6/src/input/checks/package_httpd_installed.xml
new file mode 100644
index 0000000..6fd21b4
--- /dev/null
+++ b/rhel6/src/input/checks/package_httpd_installed.xml
@@ -0,0 +1,25 @@
+<def-group>
+  <definition class="compliance" id="package_httpd_installed"
+  version="1">
+    <metadata>
+      <title>Package httpd Installed</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="4346-3" source="CCE" />
+      <description>The RPM package httpd should be installed if Apache Web services are a requirement.</description>
+    </metadata>
+    <criteria>
+      <criterion comment="package httpd is installed"
+      test_ref="test_package_httpd_installed" />
+    </criteria>
+  </definition>
+  <linux:rpminfo_test check="all" check_existence="all_exist"
+  id="test_package_httpd_installed" version="1"
+  comment="package httpd is installed">
+    <linux:object object_ref="obj_package_httpd_installed" />
+  </linux:rpminfo_test>
+  <linux:rpminfo_object id="obj_package_httpd_installed" version="1">
+    <linux:name>httpd</linux:name>
+  </linux:rpminfo_object>
+</def-group>
diff --git a/rhel6/src/input/services/http.xml b/rhel6/src/input/services/http.xml
index 0edea8b..ec208e1 100644
--- a/rhel6/src/input/services/http.xml
+++ b/rhel6/src/input/services/http.xml
@@ -26,11 +26,13 @@ and removed from the system.
 <title>Disable httpd Service</title>
 <description>
 The <tt>httpd</tt> service can be disabled with the following command:
-<pre># chkconfig httpd off</pre>
+<pre>
+# chkconfig httpd off
+</pre>
 </description>
 <rationale>
-Running web server software provides a network-based avenue
-of attack, and should be disabled if not needed.
+Running web server software provides a network-based avenue 
+of attack, and should be disabled if not needed.    
 </rationale>
 <ident cce="4338-0" />
 <oval id="service_httpd_disabled" />
@@ -39,9 +41,11 @@ of attack, and should be disabled if not needed.
 
 <Rule id="uninstall_httpd">
 <title>Uninstall httpd Package</title>
-<description>The <tt>httpd</tt> package can be uninstalled with
+<description>The <tt>httpd</tt> package can be uninstalled with 
 the following command:
-<pre># yum erase httpd</pre>
+<pre>
+# yum erase httpd
+</pre>
 </description>
 <rationale>
 If there is no need to make the web server software available,
@@ -52,5 +56,205 @@ removing it provides a safeguard against its activation.
 <ref nist="CM-6, CM-7" />
 </Rule>
 </Group>
+
+<Group id="installing_httpd">
+<title>Disable Apache if Possible</title>
+<description>If Apache was not installed and activated, but the system
+needs to act as a web server, then it should be installed on the system.
+</description>
+
+<Rule id="install_httpd">
+<title>Install httpd Package</title>
+<description>If the Apache web server must be run, follow these
+guidelines to install it defensively. The <tt>httpd</tt> package can be installed with 
+the following command:
+<pre>
+# yum install httpd
+</pre>
+This method of installation is recommended over installing the "Web Server" package group
+during the system installation process. The Web Server package group inscludes many packages 
+which are likely extraneous, while the command-line method installs only the required <tt>httpd</tt> 
+package itself.
+</description>
+<rationale>
+This method of installation is recommended over installing the "Web Server" package group
+during the system installation process. The Web Server package group inscludes many packages 
+which are likely extraneous, while the command-line method installs only the required <tt>httpd</tt> 
+package itself.
+</rationale>
+<ident cce="4346-3" />
+<oval id="package_httpd_installed" />
+<ref nist="CM-6, CM-7" />
+</Rule>
+
+<Rule id="httpd_minimal_modules_installed">
+<title>Confirm Minimal Built-in Modules Installed</title>
+<description>The default Apache installation minimizes the number of modules that are compiled
+directly into the binary (<tt>core prefork http_core mod_so</tt>). This minimizes risk by limiting
+the capabilities allowed by the webserver.
+
+Query the set of compiled-in modules using the following command:
+<pre>
+$ httpd -l
+</pre>
+If the number of compiled-in modules is significantly larger than the aforementioned set, this
+guide recommends reinstallating Apache with a reduced configuration.
+</description>
+<rationale>
+Minimizing the number of modules that are compiled into the <tt>httpd</tt> binary, reduces risk
+by limiting the capabilities allowed by the webserver.
+</rationale>
+<!--<ident cce="4346-3" />-->
+<!--<oval id="httpd_minimal_modules_installed" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+</Group>
+
+<Group id="securing_httpd">
+<title>Secure the Apache Configuration</title>
+<description>The Apache configuration file is <tt>/etc/httpd/conf/httpd.conf</tt>. Apply 
+the recommendations in the remainder of this section to this file.
+</description>
+
+<Group id="httpd_restrict_info_leakage">
+<title>Restrict Web Server Information Leakage</title>
+<description>
+The <tt>ServerTokens</tt> and <tt>ServerSignature</tt> directives determine how
+much information the web server discloses about the configuration of the system. <tt>ServerSignature Off</tt>
+keeps Apache from displaying the server version on error pages. It is a good security 
+practice to limit the information provided to clients.
+</description>
+
+<Rule id="httpd_servertokens_prod">
+<title><tt>ServerTokens</tt> Directive is set to <tt>Prod</tt></title>
+<description>
+<tt>ServerTokens Prod</tt> restricts information in page headers, returning only the word “Apache.”
+
+Add or correct the following directive in <tt>/etc/httpd/conf/httpd.conf</tt>:
+<pre>
+ServerTokens Prod
+</pre>
+</description>
+<rationale>
+Information disclosed to clients about the configuration of the web server and system could be used
+to plan an attack on the given system. This information disclosure should be restricted to a minimum. 
+</rationale>
+<ident cce="4474-3" />
+<oval id="httpd_servertokens_prod" />
+<ref nist="CM-6, CM-7" />
+</Rule>
+
+<Rule id="httpd_serversignature_off">
+<title><tt>ServerSignature</tt> Directive is set to <tt>Off</tt></title>
+<description>
+<tt>ServerSignature Off</tt> restricts Apache from displaying server version number
+on error pages.
+
+Add or correct the following directive in <tt>/etc/httpd/conf/httpd.conf</tt>:
+<pre>
+ServerSignature Off
+</pre>
+</description>
+<rationale>
+Information disclosed to clients about the configuration of the web server and system could be used
+to plan an attack on the given system. This information disclosure should be restricted to a minimum. 
+</rationale>
+<ident cce="3756-4" />
+<oval id="httpd_serversignature_off" />
+<ref nist="CM-6, CM-7" />
+</Rule>
+</Group>
+
+<Group id="httpd_minimize_loadable_modules">
+<title>Minimize Web Server Loadable Modules</title>
+<description>
+A default installation of Apache includes a plethora of “dynamically shared objects” (DSO)
+that are loaded at run-time. Unlike the aforementioned “compiled-in” modules, a DSO can be
+disabled in the configuration file by removing the corresponding LoadModule directive.
+
+Note: A DSO only provides additional functionality if associated directives are included 
+in the Apache configuration file. It should also be noted that removing a DSO will produce
+errors on Apache startup if the configuration file contains directives that apply to that
+module. Refer to <tt>http://httpd.apache.org/docs/</tt> for details on which directives
+are associated with each DSO.
+
+Following each DSO removal, the configuration can be tested with the following command
+to check if everything still works:
+<pre>
+# service httpd configtest
+</pre>
+The purpose of each of the modules loaded by default will now be addressed one at a time.
+If none of a module’s directives are being used, remove it.
+</description>
+
+<Rule id="httpd_core_modules">
+<title>Apache Core Modules</title>
+<description>
+These modules comprise a basic subset of modules that are likely needed for base Apache
+functionality; ensure they are not commented out in <tt>/etc/httpd/conf/httpd.conf</tt>:
+<pre>
+LoadModule auth_basic_module modules/mod_auth_basic.so
+LoadModule authn_default_module modules/mod_authn_default.so
+LoadModule authz_host_module modules/mod_authz_host.so
+LoadModule authz_user_module modules/mod_authz_user.so
+LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
+LoadModule authz_default_module modules/mod_authz_default.so
+LoadModule log_config_module modules/mod_log_config.so
+LoadModule logio_module modules/mod_logio.so
+LoadModule setenvif_module modules/mod_setenvif.so
+LoadModule mime_module modules/mod_mome.so
+LoadModule autoindex_module modules/mod_autoindex.so
+LoadModule negotiation_module modules/mod_negotiation.so
+LoadModule dir_module modules/mod_dir.so
+LoadModule alias_module modules/mod_alias.so
+</pre>
+</description>
+<rationale>
+Minimizing the number of loadable modules available to the web server, reduces risk
+by limiting the capabilities allowed by the web server. 
+</rationale>
+<!--<ident cce="4474-3" />-->
+<!--<oval id="httpd_core_modules" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+<Rule id="httpd_basic_authentication">
+<title>HTTP Basic Authentication</title>
+<description>
+The following modules are necessary if this web server will provide content that will
+be restricted by a password.
+Authentication can be performed using local plain text password files (<tt>authn_file</tt>),
+local DBM password files (<tt>authn_dbm</tt>) or an LDAP directory. The only module required by
+the web server depends on your choice of authentication. Comment out the modules you don’t
+need from the following:
+<pre>
+LoadModule authn_file_module modules/mod_authn_file.so
+LoadModule authn_dbm_module modules/mod_authn_dbm.so
+</pre>
+<tt>authn alias</tt> allows for authentication based on aliases. <tt>authn anon</tt>
+allows anonymous authentication similar to that of anonymous ftp sites. <tt>authz owner</tt>
+allows authorization based on file ownership. <tt>authz dbm</tt> allows for authorization
+based on group membership if the web server is using DBM authentication.
+If the above functionality is unnecessary, comment out the related module:
+<pre>
+#LoadModule authn_alias_module modules/mod_authn_alias.so
+#LoadModule authn_anon_module modules/mod_authn_anon.so
+#LoadModule authz_owner_module modules/mod_authz_owner.so
+#LoadModule authz_dbm_module modules/mod_authz_dbm.so
+</pre>
+</description>
+<rationale>
+Minimizing the number of loadable modules available to the web server, reduces risk
+by limiting the capabilities allowed by the web server.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<!--<oval id="httpd_serversignature_off" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+</Group>
+
+</Group>
+
 </Group>
 
-- 
1.7.7.6


--------------060302030708000108020305
Content-Type: text/x-patch;
 name="0002-Added-more-XCCDF-content.patch"
Content-Transfer-Encoding: 8bit
Content-Disposition: attachment;
 filename="0002-Added-more-XCCDF-content.patch"



More information about the scap-security-guide mailing list