[PATCH 17/18] Changes to http.xml based on feedback and XCCDF rules.

Willy Santos wsantos at redhat.com
Wed Apr 18 19:56:14 UTC 2012


---
 rhel6/src/input/services/http.xml |  164 ++++++++++---------------------------
 1 files changed, 42 insertions(+), 122 deletions(-)

diff --git a/rhel6/src/input/services/http.xml b/rhel6/src/input/services/http.xml
index fa936b8..a9d2878 100644
--- a/rhel6/src/input/services/http.xml
+++ b/rhel6/src/input/services/http.xml
@@ -16,8 +16,8 @@ The system's default web server software is Apache 2 and is
 provided in the RPM package <tt>httpd</tt>.</description>
 
 <Group id="disabling_httpd">
-<title>Disable Apache if Possible</title>
-<description>If Apache was installed and activated, but the system
+<title>Disable <tt>httpd</tt> if Possible</title>
+<description>If <tt>httpd</tt> was installed and activated, but the system
 does not need to act as a web server, then it should be disabled
 and removed from the system.
 </description>
@@ -55,54 +55,41 @@ removing it provides a safeguard against its activation.
 </Group> <!--<Group id="disabling_httpd"> -->
 
 <Group id="installing_httpd">
-<title>Install Apache if Necessary</title>
-<description>If Apache was not installed and activated, but the system
-needs to act as a web server, then it should be installed on the system.
-</description>
-
-<Rule id="install_httpd">
-<title>Install Apache Software Safely</title>
-<description>If the Apache web server must be run, follow these
+<title>Install <tt>httpd</tt> if Necessary</title>
+<description>If <tt>httpd</tt> was not installed and activated, but the system
+needs to act as a web server, then it should be installed on the system. Follow these
 guidelines to install it defensively. The <tt>httpd</tt> package can be installed with 
 the following command:
 <pre># yum install httpd</pre>
-</description>
-<rationale>
 This method of installation is recommended over installing the "Web Server" package group
 during the system installation process. The Web Server package group inscludes many packages 
 which are likely extraneous, while the command-line method installs only the required <tt>httpd</tt> 
 package itself.
-</rationale>
+</description>
 <ident cce="4346-3" />
 <oval id="package_httpd_installed" />
 <ref nist="CM-6, CM-7" />
-</Rule>
 
-<Rule id="httpd_minimal_modules_installed">
+<Group id="httpd_minimal_modules_installed">
 <title>Confirm Minimal Built-in Modules Installed</title>
-<description>The default Apache installation minimizes the number of modules that are compiled
+<description>The default <tt>httpd</tt> installation minimizes the number of modules that are compiled
 directly into the binary (<tt>core prefork http_core mod_so</tt>). This minimizes risk by limiting
 the capabilities allowed by the webserver.
 
 Query the set of compiled-in modules using the following command:
 <pre>$ httpd -l</pre>
 If the number of compiled-in modules is significantly larger than the aforementioned set, this
-guide recommends reinstallating Apache with a reduced configuration.
-</description>
-<rationale>
-Minimizing the number of modules that are compiled into the <tt>httpd</tt> binary, reduces risk
+guide recommends reinstallating <tt>httpd</tt> with a reduced configuration. Minimizing the number of modules that are compiled into the <tt>httpd</tt> binary, reduces risk
 by limiting the capabilities allowed by the webserver.
-</rationale>
-<!--<ident cce="4346-3" />-->
-<!--<oval id="httpd_minimal_modules_installed" />-->
-<!--<ref nist="CM-6, CM-7" />-->
-</Rule>
+</description>
+
+</Group> <!-- <Group id="httpd_minimal_modules_installed"> -->
 
 </Group> <!-- <Group id="installing_httpd"> -->
 
 <Group id="securing_httpd">
-<title>Secure the Apache Configuration</title>
-<description>The Apache configuration file is <tt>/etc/httpd/conf/httpd.conf</tt>. Apply 
+<title>Secure the <tt>httpd</tt> Configuration</title>
+<description>The <tt>httpd</tt> configuration file is <tt>/etc/httpd/conf/httpd.conf</tt>. Apply 
 the recommendations in the remainder of this section to this file.
 </description>
 
@@ -111,7 +98,7 @@ the recommendations in the remainder of this section to this file.
 <description>
 The <tt>ServerTokens</tt> and <tt>ServerSignature</tt> directives determine how
 much information the web server discloses about the configuration of the system. <tt>ServerSignature Off</tt>
-keeps Apache from displaying the server version on error pages. It is a good security 
+keeps <tt>httpd</tt> from displaying the server version on error pages. It is a good security 
 practice to limit the information provided to clients.
 </description>
 
@@ -135,7 +122,7 @@ to plan an attack on the given system. This information disclosure should be res
 <Rule id="httpd_serversignature_off">
 <title><tt>ServerSignature</tt> Directive is set to <tt>Off</tt></title>
 <description>
-<tt>ServerSignature Off</tt> restricts Apache from displaying server version number
+<tt>ServerSignature Off</tt> restricts <tt>httpd</tt> from displaying server version number
 on error pages.
 <br /><br />
 Add or correct the following directive in <tt>/etc/httpd/conf/httpd.conf</tt>:
@@ -149,18 +136,19 @@ to plan an attack on the given system. This information disclosure should be res
 <oval id="httpd_serversignature_off" />
 <ref nist="CM-6, CM-7" />
 </Rule>
+
 </Group> <!-- <Group id="httpd_restrict_info_leakage"> -->
 
 <Group id="httpd_minimize_loadable_modules">
 <title>Minimize Web Server Loadable Modules</title>
 <description>
-A default installation of Apache includes a plethora of “dynamically shared objects” (DSO)
+A default installation of <tt>httpd</tt> includes a plethora of “dynamically shared objects” (DSO)
 that are loaded at run-time. Unlike the aforementioned “compiled-in” modules, a DSO can be
 disabled in the configuration file by removing the corresponding LoadModule directive.
 <br /><br />
 Note: A DSO only provides additional functionality if associated directives are included 
-in the Apache configuration file. It should also be noted that removing a DSO will produce
-errors on Apache startup if the configuration file contains directives that apply to that
+in the <tt>httpd</tt> configuration file. It should also be noted that removing a DSO will produce
+errors on <tt>httpd</tt> startup if the configuration file contains directives that apply to that
 module. Refer to <tt>http://httpd.apache.org/docs/</tt> for details on which directives
 are associated with each DSO.
 <br /><br />
@@ -171,10 +159,10 @@ The purpose of each of the modules loaded by default will now be addressed one a
 If none of a module’s directives are being used, remove it.
 </description>
 
-<Rule id="httpd_core_modules">
-<title>Apache Core Modules</title>
+<Group id="httpd_core_modules">
+<title><tt>httpd</tt> Core Modules</title>
 <description>
-These modules comprise a basic subset of modules that are likely needed for base Apache
+These modules comprise a basic subset of modules that are likely needed for base <tt>httpd</tt>
 functionality; ensure they are not commented out in <tt>/etc/httpd/conf/httpd.conf</tt>:
 <pre>LoadModule auth_basic_module modules/mod_auth_basic.so
 LoadModule authn_default_module modules/mod_authn_default.so
@@ -190,15 +178,9 @@ LoadModule autoindex_module modules/mod_autoindex.so
 LoadModule negotiation_module modules/mod_negotiation.so
 LoadModule dir_module modules/mod_dir.so
 LoadModule alias_module modules/mod_alias.so</pre>
-</description>
-<rationale>
 Minimizing the number of loadable modules available to the web server, reduces risk
 by limiting the capabilities allowed by the web server. 
-</rationale>
-<!--<ident cce="4474-3" />-->
-<!--<oval id="httpd_core_modules" />-->
-<!--<ref nist="CM-6, CM-7" />-->
-</Rule>
+</description>
 
 <Rule id="httpd_basic_authentication">
 <title>HTTP Basic Authentication</title>
@@ -415,7 +397,7 @@ by limiting the capabilities allowed by the web server.
 <Rule id="httpd_proxy_support">
 <title>Proxy Support</title>
 <description>
-This module provides proxying support, allowing Apache to forward requests and
+This module provides proxying support, allowing <tt>httpd</tt> to forward requests and
 serve as a gateway for other servers.
 <br /><br />
 If the above functionality is unnecessary, comment out the related modules:
@@ -443,7 +425,7 @@ by limiting the capabilities allowed by the web server.
 <Rule id="httpd_cache_support">
 <title>Cache Support</title>
 <description>
-This module allows Apache to cache data, optimizing access to frequently accessed
+This module allows <tt>httpd</tt> to cache data, optimizing access to frequently accessed
 content. However, not only is it an experimental module, but it also introduces
 potential security flaws into the web server such as the possibility of circumventing
 <tt>Allow</tt> and <tt>Deny</tt> directives.
@@ -522,7 +504,7 @@ by limiting the capabilities allowed by the web server.
 <Rule id="httpd_minimize_config_files_included">
 <title>Minimize Configuration Files Included</title>
 <description>
-The <tt>Include</tt> directive directs Apache to load supplementary configuration files
+The <tt>Include</tt> directive directs <tt>httpd</tt> to load supplementary configuration files
 from a provided path. The default configuration loads all files that end in <tt>.conf</tt>
 from the <tt>/etc/httpd/conf.d</tt> directory.
 <br /><br />
@@ -545,6 +527,8 @@ part of the server's running configuration.
 <!--<ref nist="CM-6, CM-7" />-->
 </Rule>
 
+</Group> <!-- <Group id="httpd_core_modules"> -->
+
 </Group> <!-- <Group id="httpd_minimize_loadable_modules"> -->
 
 <Group id="httpd_directory_restrictions">
@@ -558,7 +542,7 @@ case-by-case basis, allowing access only where needed.
 <Rule id="httpd_restrict_root_directory">
 <title>Restrict Root Directory</title>
 <description>
-The Apache root directory should always have the most restrictive configuration enabled.
+The <tt>httpd</tt> root directory should always have the most restrictive configuration enabled.
 <pre>&lt;Directory / &gt;
    Options None
    AllowOverride None
@@ -646,9 +630,9 @@ by limiting the capabilities allowed by the web server.
 </Group> <!-- <Group id="httpd_directory_restrictions"> -->
 
 <Group id="httpd_modules_improve_security">
-<title>Use Appropriate Modules to Improve Apache's Security</title>
+<title>Use Appropriate Modules to Improve <tt>httpd</tt>'s Security</title>
 <description>
-Among the modules available for Apache are several whose use may improve the
+Among the modules available for <tt>httpd</tt> are several whose use may improve the
 security of the web server installation. This section recommends and discusses
 the deployment of security-relevant modules.
 </description>
@@ -674,7 +658,7 @@ Install the <tt>mod_ssl</tt> module:
 <pre># yum install mod_ssl</pre>
 </description>
 <rationale>
-<tt>mod_ssl</tt> provides encryption capabilites for the Apache Web server. Unencrypted
+<tt>mod_ssl</tt> provides encryption capabilites for the <tt>httpd</tt> Web server. Unencrypted
 content is transmitted in plain text which could be passively monitored and accessed by
 unauthorized parties.
 </rationale>
@@ -688,7 +672,7 @@ unauthorized parties.
 <Group id="httpd_deploy_mod_security">
 <title>Deploy <tt>mod_security</tt></title>
 <description>
-mod security provides an application level firewall for Apache. Following the installation
+mod security provides an application level firewall for <tt>httpd</tt>. Following the installation
 of mod security with the base ruleset, specific configuration advice can be found at 
 http://www.modsecurity.org/ to design a policy that best matches the security needs of 
 the web applications.
@@ -784,23 +768,8 @@ web server, in order to provide as safe an environment as possible for the web s
 <Group id="httpd_restrict_file_dir_access">
 <title>Restrict File and Directory Access</title>
 <description>
-Minimize access to critical Apache files and directories.
-</description>
-
-<Rule id="httpd_binary_permissions">
-<title>Set correct permissions to <tt>/usr/sbin/httpd</tt> file</title>
-<description>
-Set the permissions on the Apache Web Server binary to 511:
-<pre># chmod 511 /usr/sbin/httpd</pre>
+Minimize access to critical <tt>httpd</tt> files and directories.
 </description>
-<rationale>
-Setting restrictive permissions to the Apache binary reduces the risk of an attacker
-gaining unauthorized access to the system and altering the web server binary.
-</rationale>
-<ident cce="4029-5" />
-<oval id="file_permissions_usr_sbin_httpd" />
-<ref nist="CM-6, CM-7" />
-</Rule>
 
 <Rule id="httpd_logs_permissions">
 <title>Set correct permissions to <tt>/var/log/httpd/</tt> directory</title>
@@ -833,7 +802,7 @@ to access information about the web server and/or to alter the server's configur
 </Rule>
 
 <Rule id="httpd_conf_files_permissions">
-<title>Set correct permissions to Apache configuration files in <tt>/etc/httpd/conf/*</tt> directory</title>
+<title>Set correct permissions to <tt>httpd</tt> configuration files in <tt>/etc/httpd/conf/*</tt> directory</title>
 <description>
 Set the permissions on the Web Server configuration files to 640:
 <pre># chmod 640 /etc/httpd/conf/*</pre>
@@ -847,84 +816,35 @@ to access information about the web server and/or to alter the server's configur
 <ref nist="CM-6, CM-7" />
 </Rule>
 
-<Rule id="httpd_conf_files_group">
-<title>Set correct group ownership to Apache configuration directory and files in
-<tt>/etc/httpd/conf/*</tt> directory</title>
-<description>
-Set the group ownership on the Web Server configuration directory and files to <tt>apache</tt>:
-<pre># chgrp -R apache /etc/httpd/conf</pre>
-</description>
-<rationale>
-The Apache web server runs as the user <tt>apache</tt>. Changing the permissions to 750 to
-the directory where Apache keeps the configuration files, as suggested in the previous section, 
-may cause Apache to be unable to read its configuration files. Changing the group ownership of 
-the <tt>/etc/httpd/conf</tt> directory to <tt>apache</tt> ensures that the Apache process can read
-its configuration files.
-</rationale>
-<ident cce="3581-6" />
-<oval id="file_group_owner_httpd_server_conf_files" />
-<ref nist="CM-6, CM-7" />
-</Rule>
-
 </Group> <!-- <Group id="httpd_restrict_file_dir_access"> -->
 
 <Group id="httpd_configure_iptables">
 <title>Configure <tt>iptables</tt> to Allow Access to the Web Server</title>
 <description>
-By default, <tt>iptables</tt> blocks access to the ports used by the web server. In order to allow
-traffic through those ports add the lines in the following sections to the <tt>iptables</tt>
-configuration file.
-</description>
-
-<Rule id="httpd_configure_iptables_http">
-<title>Allow port 80 (HTTP) traffic through <tt>iptables</tt></title>
-<description>
+By default, <tt>iptables</tt> blocks access to the ports used by the web server. 
 To configure <tt>iptables</tt> to allow port 80 traffic edit <tt>/etc/sysconfig/iptables</tt>. 
 Add the following line, ensuring that it appears before the final LOG and DROP lines for 
 the RH-Firewall-1-INPUT chain:
 <pre>-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT</pre>
-</description>
-<rationale>
-The default <tt>iptables</tt> configuration does not allow inbound access to the HTTP (80) 
-port used by the web server. This modification allows that access, while keeping other ports 
-on the server in their default protected state.
-</rationale>
-<!-- <ident cce="4574-0" /> -->
-<oval id="iptables_http_enabled" />
-<!-- <ref nist="CM-6, CM-7" /> -->
-</Rule>
-
-<Rule id="httpd_configure_iptables_https">
-<title>Allow port 443 (HTTPS) traffic through <tt>iptables</tt></title>
-<description>
 To configure <tt>iptables</tt> to allow port 443 traffic edit <tt>/etc/sysconfig/iptables</tt>. 
 Add the following line, ensuring that it appears before the final LOG and DROP lines for 
 the RH-Firewall-1-INPUT chain:
 <pre>-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT</pre>
 </description>
-<rationale>
-The default <tt>iptables</tt> configuration does not allow inbound access to the HTTPS (443) 
-port used by the web server. This modification allows that access, while keeping other ports 
-on the server in their default protected state.
-</rationale>
-<!-- <ident cce="4574-0" /> -->
-<oval id="iptables_https_enabled" />
-<!-- <ref nist="CM-6, CM-7" /> -->
-</Rule>
 
 </Group> <!-- <Group id="httpd_configure_iptables"> -->
 
 <Group id="httpd_chroot">
-<title>Run Apache in a <tt>chroot</tt> Jail if Possible</title>
+<title>Run <tt>httpd</tt> in a <tt>chroot</tt> Jail if Possible</title>
 <description>
-Putting Apache in a <tt>chroot</tt> jail minimizes the damage done by a potential break-in 
+Putting <tt>httpd</tt> in a <tt>chroot</tt> jail minimizes the damage done by a potential break-in 
 by isolating the web server to a small section of the filesystem.
 <br /><br />
-In order to configure Apache to run from a <tt>chroot</tt> directory, edit the Apache configuration 
+In order to configure <tt>httpd</tt> to run from a <tt>chroot</tt> directory, edit the <tt>httpd</tt> configuration 
 file, <tt>/etc/httpd/conf/httpd.conf</tt>, and add the directive:
 <pre>SecChrootDir /chroot/apache</pre>
-It is also necessary to place all files required by Apache inside the filesystem rooted at 
-<tt>/chroot/apache</tt> , including Apache’s binaries, modules, configuration files, and 
+It is also necessary to place all files required by <tt>httpd</tt> inside the filesystem rooted at 
+<tt>/chroot/apache</tt> , including <tt>httpd</tt>’s binaries, modules, configuration files, and 
 served web pages. The details of this configuration are beyond the scope of this guide.
 </description>
 
-- 
1.7.7.6


--------------010806010007060209030405
Content-Type: text/x-patch;
 name="0018-Removed-unnecessary-checks-after-updating-XCCDF-serv.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename*0="0018-Removed-unnecessary-checks-after-updating-XCCDF-serv.pa";
 filename*1="tch"



More information about the scap-security-guide mailing list