[PATCH] consolidated httpd XCCDF commit

Jeffrey Blank blank at eclipse.ncsc.mil
Wed Apr 25 00:09:13 UTC 2012


This patch is a consolidation of Willy's commits for XCCDF content for Apache
configuration.  I believe this captures the information, and will make the
commit log a bit clearer.

Aside from consolidation, I made the following modifications: mod_auth_digest
was experimental in apache 2.0, not in 2.2, so i updated the text.  Same thing
for ditto for mod_cache.  The Apache docs are an excellent resource, especially
since 1.3 was originally shipped/supported on RHEL 5 (and we are updating 
for 2.2 on RHEL 6).

mod_disk_cache, mod_file_cache, mod_mem_cache all require mod_cache, so
I changed the rule to only require that mod_cache not exist, as our
goal is to provide a compliance check against caching.

It appears that chroot capability is now supported out of the box (not
just via mod_security), so this is noted in the httpd_chroot section.

I added a style note to the wiki (XCCDF Rule-writing section) about
Rule titles: they should be imperative when possible.  I also updated 
many of the Rule titles with initial caps, which is consistent with the 
rest of the document.

Grammatical pet peeve: removed instances of "and/or".

Minor note: using <tt> tags inside a title is fine, but it gets
stripped out by shorthand2xccdf.xslt.  For some reason, the XCCDF spec
does not allow for XHTML tags inside a title (and despite the
aesthetic loss, we should try to derive all human-readable output from
valid XCCDF).

I changed a few Rules to Groups.  This occurred when it wasn't clear that
it would be practical to create a granular check (using any mechanism) or when
helpful information was being provided (versus potential compliance
requirements).  Some Groups may later be broken out into several Rules
if there is motivation.

The default permissions on /var/log/httpd are more restrictive (at 700) than
what the RHEL 5 guide originally suggested (750), and so I updated this Rule.  
(I have not yet updated the OVAL, however.)

The original Apache guidance in the SNAC guide was definitely not written in a
manner that was easy to translate to XCCDF.  I suspect that another round of
edits may be called for, but this has already gotten two rounds of
translation/edits, so I'm offering it for a commit...

Jeffrey Blank (1):
  added significant body of apache configuration guidance

 rhel6/src/input/services/http.xml |  789 +++++++++++++++++++++++++++++++++++++
 1 files changed, 789 insertions(+), 0 deletions(-)



More information about the scap-security-guide mailing list