[PATCH 02/18] Added more XCCDF content.

Willy Santos wsantos at redhat.com
Tue Apr 3 21:36:34 UTC 2012


---
 rhel6/src/input/services/http.xml |  490 +++++++++++++++++++++++++++++++++----
 1 files changed, 440 insertions(+), 50 deletions(-)

diff --git a/rhel6/src/input/services/http.xml b/rhel6/src/input/services/http.xml
index ec208e1..4d8f372 100644
--- a/rhel6/src/input/services/http.xml
+++ b/rhel6/src/input/services/http.xml
@@ -26,9 +26,7 @@ and removed from the system.
 <title>Disable httpd Service</title>
 <description>
 The <tt>httpd</tt> service can be disabled with the following command:
-<pre>
-# chkconfig httpd off
-</pre>
+<pre># chkconfig httpd off</pre>
 </description>
 <rationale>
 Running web server software provides a network-based avenue 
@@ -43,9 +41,7 @@ of attack, and should be disabled if not needed.
 <title>Uninstall httpd Package</title>
 <description>The <tt>httpd</tt> package can be uninstalled with 
 the following command:
-<pre>
-# yum erase httpd
-</pre>
+<pre># yum erase httpd</pre>
 </description>
 <rationale>
 If there is no need to make the web server software available,
@@ -55,26 +51,21 @@ removing it provides a safeguard against its activation.
 <oval id="package_httpd_removed" />
 <ref nist="CM-6, CM-7" />
 </Rule>
-</Group>
+
+</Group> <!--<Group id="disabling_httpd"> -->
 
 <Group id="installing_httpd">
-<title>Disable Apache if Possible</title>
+<title>Install Apache if Necessary</title>
 <description>If Apache was not installed and activated, but the system
 needs to act as a web server, then it should be installed on the system.
 </description>
 
 <Rule id="install_httpd">
-<title>Install httpd Package</title>
+<title>Install Apache Software Safely</title>
 <description>If the Apache web server must be run, follow these
 guidelines to install it defensively. The <tt>httpd</tt> package can be installed with 
 the following command:
-<pre>
-# yum install httpd
-</pre>
-This method of installation is recommended over installing the "Web Server" package group
-during the system installation process. The Web Server package group inscludes many packages 
-which are likely extraneous, while the command-line method installs only the required <tt>httpd</tt> 
-package itself.
+<pre># yum install httpd</pre>
 </description>
 <rationale>
 This method of installation is recommended over installing the "Web Server" package group
@@ -94,9 +85,7 @@ directly into the binary (<tt>core prefork http_core mod_so</tt>). This minimize
 the capabilities allowed by the webserver.
 
 Query the set of compiled-in modules using the following command:
-<pre>
-$ httpd -l
-</pre>
+<pre>$ httpd -l</pre>
 If the number of compiled-in modules is significantly larger than the aforementioned set, this
 guide recommends reinstallating Apache with a reduced configuration.
 </description>
@@ -108,7 +97,8 @@ by limiting the capabilities allowed by the webserver.
 <!--<oval id="httpd_minimal_modules_installed" />-->
 <!--<ref nist="CM-6, CM-7" />-->
 </Rule>
-</Group>
+
+</Group> <!-- <Group id="installing_httpd"> -->
 
 <Group id="securing_httpd">
 <title>Secure the Apache Configuration</title>
@@ -129,11 +119,9 @@ practice to limit the information provided to clients.
 <title><tt>ServerTokens</tt> Directive is set to <tt>Prod</tt></title>
 <description>
 <tt>ServerTokens Prod</tt> restricts information in page headers, returning only the word “Apache.”
-
+<br /><br />
 Add or correct the following directive in <tt>/etc/httpd/conf/httpd.conf</tt>:
-<pre>
-ServerTokens Prod
-</pre>
+<pre>ServerTokens Prod</pre>
 </description>
 <rationale>
 Information disclosed to clients about the configuration of the web server and system could be used
@@ -149,11 +137,9 @@ to plan an attack on the given system. This information disclosure should be res
 <description>
 <tt>ServerSignature Off</tt> restricts Apache from displaying server version number
 on error pages.
-
+<br /><br />
 Add or correct the following directive in <tt>/etc/httpd/conf/httpd.conf</tt>:
-<pre>
-ServerSignature Off
-</pre>
+<pre>ServerSignature Off</pre>
 </description>
 <rationale>
 Information disclosed to clients about the configuration of the web server and system could be used
@@ -163,7 +149,7 @@ to plan an attack on the given system. This information disclosure should be res
 <oval id="httpd_serversignature_off" />
 <ref nist="CM-6, CM-7" />
 </Rule>
-</Group>
+</Group> <!-- <Group id="httpd_restrict_info_leakage"> -->
 
 <Group id="httpd_minimize_loadable_modules">
 <title>Minimize Web Server Loadable Modules</title>
@@ -171,18 +157,16 @@ to plan an attack on the given system. This information disclosure should be res
 A default installation of Apache includes a plethora of “dynamically shared objects” (DSO)
 that are loaded at run-time. Unlike the aforementioned “compiled-in” modules, a DSO can be
 disabled in the configuration file by removing the corresponding LoadModule directive.
-
+<br /><br />
 Note: A DSO only provides additional functionality if associated directives are included 
 in the Apache configuration file. It should also be noted that removing a DSO will produce
 errors on Apache startup if the configuration file contains directives that apply to that
 module. Refer to <tt>http://httpd.apache.org/docs/</tt> for details on which directives
 are associated with each DSO.
-
+<br /><br />
 Following each DSO removal, the configuration can be tested with the following command
 to check if everything still works:
-<pre>
-# service httpd configtest
-</pre>
+<pre># service httpd configtest</pre>
 The purpose of each of the modules loaded by default will now be addressed one at a time.
 If none of a module’s directives are being used, remove it.
 </description>
@@ -192,8 +176,7 @@ If none of a module’s directives are being used, remove it.
 <description>
 These modules comprise a basic subset of modules that are likely needed for base Apache
 functionality; ensure they are not commented out in <tt>/etc/httpd/conf/httpd.conf</tt>:
-<pre>
-LoadModule auth_basic_module modules/mod_auth_basic.so
+<pre>LoadModule auth_basic_module modules/mod_auth_basic.so
 LoadModule authn_default_module modules/mod_authn_default.so
 LoadModule authz_host_module modules/mod_authz_host.so
 LoadModule authz_user_module modules/mod_authz_user.so
@@ -206,8 +189,7 @@ LoadModule mime_module modules/mod_mome.so
 LoadModule autoindex_module modules/mod_autoindex.so
 LoadModule negotiation_module modules/mod_negotiation.so
 LoadModule dir_module modules/mod_dir.so
-LoadModule alias_module modules/mod_alias.so
-</pre>
+LoadModule alias_module modules/mod_alias.so</pre>
 </description>
 <rationale>
 Minimizing the number of loadable modules available to the web server, reduces risk
@@ -223,38 +205,446 @@ by limiting the capabilities allowed by the web server.
 <description>
 The following modules are necessary if this web server will provide content that will
 be restricted by a password.
+<br /><br />
 Authentication can be performed using local plain text password files (<tt>authn_file</tt>),
 local DBM password files (<tt>authn_dbm</tt>) or an LDAP directory. The only module required by
 the web server depends on your choice of authentication. Comment out the modules you don’t
 need from the following:
-<pre>
-LoadModule authn_file_module modules/mod_authn_file.so
-LoadModule authn_dbm_module modules/mod_authn_dbm.so
-</pre>
+<pre>LoadModule authn_file_module modules/mod_authn_file.so
+LoadModule authn_dbm_module modules/mod_authn_dbm.so</pre>
 <tt>authn alias</tt> allows for authentication based on aliases. <tt>authn anon</tt>
 allows anonymous authentication similar to that of anonymous ftp sites. <tt>authz owner</tt>
 allows authorization based on file ownership. <tt>authz dbm</tt> allows for authorization
 based on group membership if the web server is using DBM authentication.
+<br /><br />
 If the above functionality is unnecessary, comment out the related module:
-<pre>
-#LoadModule authn_alias_module modules/mod_authn_alias.so
+<pre>#LoadModule authn_alias_module modules/mod_authn_alias.so
 #LoadModule authn_anon_module modules/mod_authn_anon.so
 #LoadModule authz_owner_module modules/mod_authz_owner.so
-#LoadModule authz_dbm_module modules/mod_authz_dbm.so
-</pre>
+#LoadModule authz_dbm_module modules/mod_authz_dbm.so</pre>
+</description>
+<rationale>
+Minimizing the number of loadable modules available to the web server, reduces risk
+by limiting the capabilities allowed by the web server.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<!--<oval id="httpd_basic_authentication" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+<Rule id="httpd_digest_authentication">
+<title>HTTP Digest Authentication</title>
+<description>
+This module provides encrypted authentication sessions. However, this module is rarely
+used and considered experimental. Alternate methods of encrypted authentication are
+recommended, such as SSL.
+<br /><br />
+If the above functionality is unnecessary, comment out the related module:
+<pre>#LoadModule auth_digest_module modules/mod_auth_digest.so</pre>
+</description>
+<rationale>
+Minimizing the number of loadable modules available to the web server, reduces risk
+by limiting the capabilities allowed by the web server.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<!--<oval id="httpd_digest_authentication" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+<Rule id="httpd_mod_rewrite">
+<title>HTTP <tt>mod_rewrite</tt></title>
+<description>
+The <tt>mod_rewrite</tt> module is very powerful and can protect against certain
+classes of web attacks. However, it is also very complex and has a significant 
+history of vulnerabilities itself.
+<br /><br />
+If the above functionality is unnecessary, comment out the related module:
+<pre>#LoadModule rewrite_module modules/mod_rewrite.so</pre>
+</description>
+<rationale>
+Minimizing the number of loadable modules available to the web server, reduces risk
+by limiting the capabilities allowed by the web server.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<!--<oval id="httpd_mod_rewrite" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+<Rule id="httpd_ldap_support">
+<title>LDAP Support</title>
+<description>
+This module provides HTTP authentication via an LDAP directory.
+<br /><br />
+If the above functionality is unnecessary, comment out the related modules:
+<pre>#LoadModule ldap_module modules/mod_ldap.so
+#LoadModule authnz_ldap_module modules/mod_authnz_ldap.so</pre>
+If LDAP is to be used, SSL encryption should be used as well.
+</description>
+<rationale>
+Minimizing the number of loadable modules available to the web server, reduces risk
+by limiting the capabilities allowed by the web server.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<!--<oval id="httpd_ldap_support" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+<Rule id="httpd_server_side_includes">
+<title>Server Side Includes</title>
+<description>
+Server Side Includes provide a method of dynamically generating web pages through the
+insertion of server-side code. However, the technology is also deprecated and
+introduces significant security concerns.
+<br /><br />
+If the above functionality is unnecessary, comment out the related module:
+<pre>#LoadModule include_module modules/mod_include.so</pre>
+If there is a critical need for Server Side Includes, they should be enabled with the
+option <tt>IncludesNoExec</tt> to prevent arbitrary code execution. Additionally, user
+supplied data should be encoded to prevent cross-site scripting vulnerabilities.
+</description>
+<rationale>
+Minimizing the number of loadable modules available to the web server, reduces risk
+by limiting the capabilities allowed by the web server.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<!--<oval id="httpd_server_side_includes" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+<Rule id="httpd_mime_magic">
+<title>MIME Magic</title>
+<description>
+This module provides a second layer of MIME support that in most configurations
+is likely extraneous. 
+<br /><br />
+If the above functionality is unnecessary, comment out the related module:
+<pre>#LoadModule mime_magic_module modules/mod_mime_magic.so</pre>
+</description>
+<rationale>
+Minimizing the number of loadable modules available to the web server, reduces risk
+by limiting the capabilities allowed by the web server.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<!--<oval id="httpd_mime_magic" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+<Rule id="httpd_webdav">
+<title>WebDAV (Distributed Authoring and Versioning)</title>
+<description>
+WebDAV is an extension of the HTTP protocol that provides distributed and
+collaborative access to web content. Due to a number of security concerns with
+WebDAV, its use is not recommended.
+<br /><br />
+If the above functionality is unnecessary, comment out the related modules:
+<pre>#LoadModule dav_module modules/mod_dav.so
+#LoadModule dav_fs_module modules/mod_dav_fs.so</pre>
+If there is a critical need for WebDAV, extra care should be taken in its configuration.
+Since DAV access allows remote clients to manipulate server files, any location on the
+server that is DAV enabled should be protected by encrypted authentication.
+</description>
+<rationale>
+Minimizing the number of loadable modules available to the web server, reduces risk
+by limiting the capabilities allowed by the web server.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<!--<oval id="httpd_webdav" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+<Rule id="httpd_server_activity_status">
+<title>Server Activity Status</title>
+<description>
+This module provides real-time access to statistics on the internal operation of
+the web server. This is an unnecessary information leak and should be disabled.
+<br /><br />
+If the above functionality is unnecessary, comment out the related module:
+<pre>#LoadModule status_module modules/mod_status.so</pre>
+If there is a critical need for this module, ensure that access to the status
+page is properly restricted to a limited set of hosts in the status handler
+configuration.
+</description>
+<rationale>
+Minimizing the number of loadable modules available to the web server, reduces risk
+by limiting the capabilities allowed by the web server.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<!--<oval id="httpd_server_activity_status" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+<Rule id="httpd_server_configuration_display">
+<title>Web Server Configuration Display</title>
+<description>
+This module creates a web page illustrating the configuration of the web server. This
+is an unnecessary security leak and should be disabled.
+<br /><br />
+If the above functionality is unnecessary, comment out the related module:
+<pre>#LoadModule info_module modules/mod_info.so</pre>
+If there is a critical need for this module, use the <tt>Location</tt> directive to provide
+an access control list to restrict access to the information.
+</description>
+<rationale>
+Minimizing the number of loadable modules available to the web server, reduces risk
+by limiting the capabilities allowed by the web server.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<!--<oval id="httpd_server_configuration_display" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+<Rule id="httpd_url_correction">
+<title>URL Correction on Misspelled Entries</title>
+<description>
+This module attempts to find a document match by allowing one misspelling in an
+otherwise failed request.
+<br /><br />
+If the above functionality is unnecessary, comment out the related module:
+<pre>#LoadModule speling_module modules/mod_speling.so</pre>
+This functionality weakens server security by making site enumeration easier.
+</description>
+<rationale>
+Minimizing the number of loadable modules available to the web server, reduces risk
+by limiting the capabilities allowed by the web server.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<!--<oval id="httpd_url_correction" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+<Rule id="httpd_proxy_support">
+<title>Proxy Support</title>
+<description>
+This module provides proxying support, allowing Apache to forward requests and
+serve as a gateway for other servers.
+<br /><br />
+If the above functionality is unnecessary, comment out the related modules:
+<pre>#LoadModule proxy_module modules/mod_proxy.so
+#LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
+#LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
+#LoadModule proxy_http_module modules/mod_proxy_http.so
+#LoadModule proxy_connect_module modules/mod_proxy_connect.so</pre>
+If proxy support is needed, load <tt>proxy</tt> and the appropriate proxy protocol handler
+module (one of <tt>proxy http</tt>, <tt>proxy ftp</tt>, or <tt>proxy connect</tt>). Additionally,
+make certain that a server is secure before enabling proxying, as open proxy servers
+are a security risk. <tt>proxy balancer</tt> enables load balancing, but requires that
+<tt>mod status</tt> be enabled. Since <tt>mod status</tt> is not recommended,
+<tt>proxy balancer</tt> should be avoided as well.
+</description>
+<rationale>
+Minimizing the number of loadable modules available to the web server, reduces risk
+by limiting the capabilities allowed by the web server.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<!--<oval id="httpd_proxy_support" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+<Rule id="httpd_cache_support">
+<title>Cache Support</title>
+<description>
+This module allows Apache to cache data, optimizing access to frequently accessed
+content. However, not only is it an experimental module, but it also introduces
+potential security flaws into the web server such as the possibility of circumventing
+<tt>Allow</tt> and <tt>Deny</tt> directives.
+<br /><br />
+If the above functionality is unnecessary, comment out the related modules:
+<pre>#LoadModule cache_module modules/mod_cache.so
+#LoadModule disk_cache_module modules/mod_disk_cache.so
+#LoadModule file_cache_module modules/mod_file_cache.so
+#LoadModule mem_cache_module modules/mod_mem_cache.so</pre>
+If caching is required, it should not be enabled for any limited-access content.
+</description>
+<rationale>
+Minimizing the number of loadable modules available to the web server, reduces risk
+by limiting the capabilities allowed by the web server.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<!--<oval id="httpd_cache_support" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+<Rule id="httpd_cgi_support">
+<title>CGI Support (and Related Modules)</title>
+<description>
+This module allows HTML to interact with the CGI web programming language.
+<br /><br />
+If the above functionality is unnecessary, comment out the related modules:
+<pre>#LoadModule cgi_module modules/mod_cgi.so
+#LoadModule env_module modules/mod_env.so
+#LoadModule actions_module modules/mod_actions.so
+#LoadModule suexec_module modules/mod_suexec.so</pre>
+If the web server requires the use of CGI, enable the <tt>cgi</tt> module. If extended
+CGI functionality is required, include the appropriate modules. <tt>env</tt> allows for
+control of the environment passed to CGI scripts. <tt>actions</tt> allows CGI events
+to be triggered when files of a certain type are requested. <tt>su exec</tt> allows
+CGI scripts to run as a specified user/group instead of as the server’s user/group.
+</description>
+<rationale>
+Minimizing the number of loadable modules available to the web server, reduces risk
+by limiting the capabilities allowed by the web server.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<!--<oval id="httpd_cgi_support" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+<Rule id="httpd_optional_components">
+<title>Various Optional Components</title>
+<description>
+The following modules perform very specific tasks, sometimes providing access to
+just a few additional directives. If this functionality is not required (or if you
+are not using these directives), comment out the associated module:
+<ul>
+<li>External filtering (response passed through external program prior to client delivery)
+<pre>#LoadModule ext_filter_module modules/mod_ext_filter.so</pre></li>
+<li>User-specified Cache Control and Expiration
+<pre>#LoadModule expires_module modules/mod_expires.so</pre></li>
+<li>Compression Output Filter (provides content compression prior to client delivery)
+<pre>#LoadModule deflate_module modules/mod_deflate.so</pre></li>
+<li>HTTP Response/Request Header Customization
+<pre>#LoadModule headers_module modules/mod_headers.so</pre></li>
+<li>User activity monitoring via cookies
+<pre>#LoadModule usertrack_module modules/mod_usertrack.so</pre></li>
+<li>Dynamically configured mass virtual hosting
+<pre>#LoadModule vhost_alias_module modules/mod_vhost_alias.so</pre></li>
+</ul>
 </description>
 <rationale>
 Minimizing the number of loadable modules available to the web server, reduces risk
 by limiting the capabilities allowed by the web server.
 </rationale>
 <!--<ident cce="3756-4" />-->
-<!--<oval id="httpd_serversignature_off" />-->
+<!--<oval id="httpd_optional_components" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+<Rule id="httpd_minimize_config_files_included">
+<title>Minimize Configuration Files Included</title>
+<description>
+The <tt>Include</tt> directive directs Apache to load supplementary configuration files
+from a provided path. The default configuration loads all files that end in <tt>.conf</tt>
+from the <tt>/etc/httpd/conf.d</tt> directory.
+<br /><br />
+To restrict excess configuration, the following line should be commented out and
+replaced with <tt>Include</tt> directives that only reference required configuration files:
+<pre>#Include conf.d/*.conf</pre>
+If the above change was made, ensure that the SSL encryption remains loaded by
+explicitly including the corresponding configuration file:
+<pre>Include conf.d/ssl.conf</pre>
+If PHP is necessary, a similar alteration must be made:
+<pre>Include conf.d/php.conf</pre>
+</description>
+<rationale>
+Explicitly listing the configuration files to be loaded during web server start-up avoids
+the possibility of unwanted or malicious configuration files to be automatically included as
+part of the server's running configuration.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<!--<oval id="httpd_minimize_config_files_included" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+</Group> <!-- <Group id="httpd_minimize_loadable_modules"> -->
+
+<Group id="httpd_directory_restrictions">
+<title>Directory Restrictions</title>
+<description>
+The Directory tags in the web server configuration file allow finer grained access
+control for a specified directory. All web directories should be configured on a
+case-by-case basis, allowing access only where needed.
+</description>
+
+<Rule id="httpd_restrict_root_directory">
+<title>Restrict Root Directory</title>
+<description>
+The Apache root directory should always have the most restrictive configuration enabled.
+<pre>&lt;Directory / &gt;
+   Options None
+   AllowOverride None
+   Order allow,deny
+&lt;/Directory&gt;</pre>
+</description>
+<rationale>
+The Web Server's root directory content should be protected from unauthorized access
+by web clients.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<!--<oval id="httpd_restrict_root_directory" />-->
 <!--<ref nist="CM-6, CM-7" />-->
 </Rule>
 
-</Group>
+<Rule id="httpd_restrict_web_directory">
+<title>Restrict Web Directory</title>
+<description>
+The default configuration for the web (<tt>/var/www/html</tt>) Directory allows directory
+indexing (<tt>Indexes</tt>) and the following of symbolic links (<tt>FollowSymLinks</tt>).
+Neither of these is recommended.
+<br /><br />
+The <tt>/var/www/html</tt> directory hierarchy should not be viewable via the web, and
+symlinks should only be followed if the owner of the symlink also owns the linked file.
+<br /><br />
+Ensure that this policy is adhered to by altering the related section of the configuration:
+<pre>&lt;Directory "/var/www/html"&gt;
+#  ...
+   Options SymLinksIfOwnerMatch
+#  ...
+&lt;/Directory&gt;</pre>
+</description>
+<rationale>
+Access to the web server's directory hierarchy could allow access to unauthorized files
+by web clients. Following sybolinc links could also allow such access.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<!--<oval id="httpd_restrict_web_directory" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+<Rule id="httpd_restrict_critical_directories">
+<title>Restrict Other Critical Directories</title>
+<description>
+All accessible web directories should be configured with similar restrictive settings.
+The <tt>Options</tt> directive should be limited to necessary functionality and the <tt>AllowOverride</tt>
+directive should be used only if needed. The <tt>Order</tt> and <tt>Deny</tt> access control tags should be used to deny access by default, allowing access only where necessary.
+</description>
+<rationale>
+Directories accessible from a web client should be configured with the least amount of
+access possible in order to avoid unauthorized access to restricted content or server information.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<!--<oval id="httpd_restrict_critical_directories" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+<Rule id="httpd_limit_available_methods">
+<title>Limit Available Methods</title>
+<description>
+Web server methods are defined in section 9 of RFC 2616 (http://www.ietf.org/rfc/rfc2616.txt). 
+If a web server does not require the implementation of all available methods, 
+they should be disabled.
+<br /><br />
+Note: <tt>GET</tt> and <tt>POST</tt> are the most common methods. A majority of the others
+are limited to the WebDAV protocol.
+<pre>&lt;Directory /var/www/html&gt;
+# ...
+   # Only allow specific methods (this command is case-sensitive!)
+   &lt;LimitExcept GET POST&gt;
+      Order allow,deny
+   &lt;/LimitExcept&gt;
+# ...
+&lt;/Directory&gt;</pre>
+</description>
+<rationale>
+Minimizing the number of available methods to the web client reduces risk
+by limiting the capabilities allowed by the web server.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<!--<oval id="httpd_limit_available_methods" />-->
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
 
-</Group>
+</Group> <!-- <Group id="httpd_directory_restrictions"> -->
 
-</Group>
+</Group> <!-- <Group id="securing_httpd"> -->
 
+</Group> <!-- <Group id="http"> -->
-- 
1.7.7.6


--------------060302030708000108020305
Content-Type: text/x-patch;
 name="0003-Added-checks-for-Apache-modules-mod_security-and-mod.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename*0="0003-Added-checks-for-Apache-modules-mod_security-and-mod.pa";
 filename*1="tch"



More information about the scap-security-guide mailing list