[PATCH 04/18] Completed prose for Apache service.

Willy Santos wsantos at redhat.com
Thu Apr 12 00:26:11 UTC 2012


---
 rhel6/src/input/services/http.xml |  287 +++++++++++++++++++++++++++++++++++++
 1 files changed, 287 insertions(+), 0 deletions(-)

diff --git a/rhel6/src/input/services/http.xml b/rhel6/src/input/services/http.xml
index 4d8f372..fa936b8 100644
--- a/rhel6/src/input/services/http.xml
+++ b/rhel6/src/input/services/http.xml
@@ -645,6 +645,293 @@ by limiting the capabilities allowed by the web server.
 
 </Group> <!-- <Group id="httpd_directory_restrictions"> -->
 
+<Group id="httpd_modules_improve_security">
+<title>Use Appropriate Modules to Improve Apache's Security</title>
+<description>
+Among the modules available for Apache are several whose use may improve the
+security of the web server installation. This section recommends and discusses
+the deployment of security-relevant modules.
+</description>
+
+<Group id="httpd_deploy_mod_ssl">
+<title>Deploy <tt>mod_ssl</tt></title>
+<description>
+Because HTTP is a plain text protocol, all traffic is susceptible to passive
+monitoring. If there is a need for confidentiality, SSL should be configured
+and enabled to encrypt content.
+<br /><br />
+Note: <tt>mod nss</tt> is a FIPS 140-2 certified alternative to <tt>mod ssl</tt>. 
+The modules share a considerable amount of code and should be nearly identical 
+in functionality. If FIPS 140-2 validation is required, then <tt>mod nss</tt> should
+be used. If it provides some feature or its greater compatibility is required, 
+then <tt>mod ssl</tt> should be used.
+</description>
+
+<Rule id="httpd_install_mod_ssl">
+<title>Install <tt>mod_ssl</tt></title>
+<description>
+Install the <tt>mod_ssl</tt> module:
+<pre># yum install mod_ssl</pre>
+</description>
+<rationale>
+<tt>mod_ssl</tt> provides encryption capabilites for the Apache Web server. Unencrypted
+content is transmitted in plain text which could be passively monitored and accessed by
+unauthorized parties.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<oval id="package_mod_ssl_installed" />
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+</Group> <!-- <Group id="httpd_deploy_mod_ssl"> -->
+
+<Group id="httpd_deploy_mod_security">
+<title>Deploy <tt>mod_security</tt></title>
+<description>
+mod security provides an application level firewall for Apache. Following the installation
+of mod security with the base ruleset, specific configuration advice can be found at 
+http://www.modsecurity.org/ to design a policy that best matches the security needs of 
+the web applications.
+</description>
+
+<Rule id="httpd_install_mod_security">
+<title>Install <tt>mod_security</tt></title>
+<description>
+Install the <tt>mod_security</tt> module:
+<pre># yum install mod_security</pre>
+</description>
+<rationale>
+<tt>mod_security</tt> provides an additional level of protection for the web server by
+enabling the administrator to implement content access policies and filters at the 
+application layer.
+</rationale>
+<!--<ident cce="3756-4" />-->
+<oval id="package_mod_security_installed" />
+<!--<ref nist="CM-6, CM-7" />-->
+</Rule>
+
+</Group> <!-- <Group id="httpd_deploy_mod_security"> -->
+
+</Group> <!-- <Group id="httpd_modules_improve_security"> -->
+
+<Group id="httpd_use_dos_protection_modules">
+<title>Use Denial-of-Service Protection Modules</title>
+<description>
+Denial-of-service attacks are difficult to detect and prevent while maintaining
+acceptable access to authorized users. However, there are a number of traffic-shaping 
+modules that attempt to address the problem. Well-known DoS protection modules include:
+<pre>mod_cband mod_bwshare mod_limitipconn mod_evasive</pre>
+It is recommended that denial-of-service prevention be implemented for the web server. 
+However, this guide leaves specific configuration details to the discretion of the reader.
+</description>
+
+</Group> <!-- <Group id="httpd_use_dos_protection_modules"> -->
+
+<Group id="httpd_configure_php_securely">
+<title>Configure PHP Securely</title>
+<description>
+PHP is a widely used and often misconfigured server-side scripting language. It should 
+be used with caution, but configured appropriately when needed.
+<br /><br />
+Make the following changes to <tt>/etc/php.ini</tt>:
+<pre># Do not expose PHP error messages to external users
+display_errors = Off
+
+# Enable safe mode
+safe_mode = On
+
+# Only allow access to executables in isolated directory
+safe_mode_exec_dir = php-required-executables-path
+
+# Limit external access to PHP environment
+safe_mode_allowed_env_vars = PHP_
+
+# Restrict PHP information leakage
+expose_php = Off
+
+# Log all errors
+log_errors = On
+
+# Do not register globals for input data
+register_globals = Off
+
+# Minimize allowable PHP post size
+post_max_size = 1K
+
+# Ensure PHP redirects appropriately
+cgi.force_redirect = 0
+
+# Disallow uploading unless necessary
+file_uploads = Off
+
+# Disallow treatment of file requests as fopen calls
+allow_url_fopen = Off
+
+# Enable SQL safe mode
+sql.safe_mode = On
+</pre>
+</description>
+
+</Group> <!-- <Group id="httpd_configure_php_securely"> -->
+
+<Group id="httpd_configure_os_protect_web_server">
+<title>Configure Operating System to Protect Web Server</title>
+<description>
+The following configuration steps should be taken on the machine which hosts the 
+web server, in order to provide as safe an environment as possible for the web server.
+</description>
+
+<Group id="httpd_restrict_file_dir_access">
+<title>Restrict File and Directory Access</title>
+<description>
+Minimize access to critical Apache files and directories.
+</description>
+
+<Rule id="httpd_binary_permissions">
+<title>Set correct permissions to <tt>/usr/sbin/httpd</tt> file</title>
+<description>
+Set the permissions on the Apache Web Server binary to 511:
+<pre># chmod 511 /usr/sbin/httpd</pre>
+</description>
+<rationale>
+Setting restrictive permissions to the Apache binary reduces the risk of an attacker
+gaining unauthorized access to the system and altering the web server binary.
+</rationale>
+<ident cce="4029-5" />
+<oval id="file_permissions_usr_sbin_httpd" />
+<ref nist="CM-6, CM-7" />
+</Rule>
+
+<Rule id="httpd_logs_permissions">
+<title>Set correct permissions to <tt>/var/log/httpd/</tt> directory</title>
+<description>
+Set the permissions on the Web Server logs directory to 750:
+<pre># chmod 750 /var/log/httpd/</pre>
+</description>
+<rationale>
+Access to the web server's log files may allow an unauthorized user or attacker
+to access information about the web server and/or to alter the server's log files.
+</rationale>
+<ident cce="4574-0" />
+<oval id="dir_perms_var_log_httpd" />
+<ref nist="CM-6, CM-7" />
+</Rule>
+
+<Rule id="httpd_conf_dir_permissions">
+<title>Set correct permissions to <tt>/etc/httpd/conf/</tt> directory</title>
+<description>
+Set the permissions on the Web Server configuration directory to 750:
+<pre># chmod 750 /etc/httpd/conf/</pre>
+</description>
+<rationale>
+Access to the web server's configuration files may allow an unauthorized user or attacker
+to access information about the web server and/or to alter the server's configuration files.
+</rationale>
+<!-- <ident cce="4574-0" /> -->
+<oval id="dir_perms_etc_httpd_conf" />
+<!-- <ref nist="CM-6, CM-7" /> -->
+</Rule>
+
+<Rule id="httpd_conf_files_permissions">
+<title>Set correct permissions to Apache configuration files in <tt>/etc/httpd/conf/*</tt> directory</title>
+<description>
+Set the permissions on the Web Server configuration files to 640:
+<pre># chmod 640 /etc/httpd/conf/*</pre>
+</description>
+<rationale>
+Access to the web server's configuration files may allow an unauthorized user or attacker
+to access information about the web server and/or to alter the server's configuration files.
+</rationale>
+<ident cce="4386-9" />
+<oval id="file_permissions_httpd_server_conf_files" />
+<ref nist="CM-6, CM-7" />
+</Rule>
+
+<Rule id="httpd_conf_files_group">
+<title>Set correct group ownership to Apache configuration directory and files in
+<tt>/etc/httpd/conf/*</tt> directory</title>
+<description>
+Set the group ownership on the Web Server configuration directory and files to <tt>apache</tt>:
+<pre># chgrp -R apache /etc/httpd/conf</pre>
+</description>
+<rationale>
+The Apache web server runs as the user <tt>apache</tt>. Changing the permissions to 750 to
+the directory where Apache keeps the configuration files, as suggested in the previous section, 
+may cause Apache to be unable to read its configuration files. Changing the group ownership of 
+the <tt>/etc/httpd/conf</tt> directory to <tt>apache</tt> ensures that the Apache process can read
+its configuration files.
+</rationale>
+<ident cce="3581-6" />
+<oval id="file_group_owner_httpd_server_conf_files" />
+<ref nist="CM-6, CM-7" />
+</Rule>
+
+</Group> <!-- <Group id="httpd_restrict_file_dir_access"> -->
+
+<Group id="httpd_configure_iptables">
+<title>Configure <tt>iptables</tt> to Allow Access to the Web Server</title>
+<description>
+By default, <tt>iptables</tt> blocks access to the ports used by the web server. In order to allow
+traffic through those ports add the lines in the following sections to the <tt>iptables</tt>
+configuration file.
+</description>
+
+<Rule id="httpd_configure_iptables_http">
+<title>Allow port 80 (HTTP) traffic through <tt>iptables</tt></title>
+<description>
+To configure <tt>iptables</tt> to allow port 80 traffic edit <tt>/etc/sysconfig/iptables</tt>. 
+Add the following line, ensuring that it appears before the final LOG and DROP lines for 
+the RH-Firewall-1-INPUT chain:
+<pre>-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT</pre>
+</description>
+<rationale>
+The default <tt>iptables</tt> configuration does not allow inbound access to the HTTP (80) 
+port used by the web server. This modification allows that access, while keeping other ports 
+on the server in their default protected state.
+</rationale>
+<!-- <ident cce="4574-0" /> -->
+<oval id="iptables_http_enabled" />
+<!-- <ref nist="CM-6, CM-7" /> -->
+</Rule>
+
+<Rule id="httpd_configure_iptables_https">
+<title>Allow port 443 (HTTPS) traffic through <tt>iptables</tt></title>
+<description>
+To configure <tt>iptables</tt> to allow port 443 traffic edit <tt>/etc/sysconfig/iptables</tt>. 
+Add the following line, ensuring that it appears before the final LOG and DROP lines for 
+the RH-Firewall-1-INPUT chain:
+<pre>-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT</pre>
+</description>
+<rationale>
+The default <tt>iptables</tt> configuration does not allow inbound access to the HTTPS (443) 
+port used by the web server. This modification allows that access, while keeping other ports 
+on the server in their default protected state.
+</rationale>
+<!-- <ident cce="4574-0" /> -->
+<oval id="iptables_https_enabled" />
+<!-- <ref nist="CM-6, CM-7" /> -->
+</Rule>
+
+</Group> <!-- <Group id="httpd_configure_iptables"> -->
+
+<Group id="httpd_chroot">
+<title>Run Apache in a <tt>chroot</tt> Jail if Possible</title>
+<description>
+Putting Apache in a <tt>chroot</tt> jail minimizes the damage done by a potential break-in 
+by isolating the web server to a small section of the filesystem.
+<br /><br />
+In order to configure Apache to run from a <tt>chroot</tt> directory, edit the Apache configuration 
+file, <tt>/etc/httpd/conf/httpd.conf</tt>, and add the directive:
+<pre>SecChrootDir /chroot/apache</pre>
+It is also necessary to place all files required by Apache inside the filesystem rooted at 
+<tt>/chroot/apache</tt> , including Apache’s binaries, modules, configuration files, and 
+served web pages. The details of this configuration are beyond the scope of this guide.
+</description>
+
+</Group> <!-- <Group id="httpd_chroot"> --> 
+
+</Group> <!-- <Group id="httpd_configure_os_protect_web_server"> -->
+
 </Group> <!-- <Group id="securing_httpd"> -->
 
 </Group> <!-- <Group id="http"> -->
-- 
1.7.7.6


--------------060302030708000108020305
Content-Type: text/x-patch;
 name="0005-Created-OVAL-check-for-etc-httpd-conf-directory-perm.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename*0="0005-Created-OVAL-check-for-etc-httpd-conf-directory-perm.pa";
 filename*1="tch"



More information about the scap-security-guide mailing list