[PATCH] added significant body of apache configuration guidance

Shawn Wells shawn at redhat.com
Wed Apr 25 01:48:42 UTC 2012


On 4/24/12 8:09 PM, Jeffrey Blank wrote:
> Signed-off-by: Jeffrey Blank<blank at eclipse.ncsc.mil>
> ---
>   rhel6/src/input/services/http.xml |  789 +++++++++++++++++++++++++++++++++++++
>   1 files changed, 789 insertions(+), 0 deletions(-)

Overall this looks like great content. A few nitpicks... and a single 
commit covering all this material? Seriously?!! ;)


> diff --git a/rhel6/src/input/services/http.xml b/rhel6/src/input/services/http.xml
> index 0edea8b..cd4d239 100644
> --- a/rhel6/src/input/services/http.xml
> +++ b/rhel6/src/input/services/http.xml
> @@ -51,6 +51,795 @@ removing it provides a safeguard against its activation.
>   <oval id="package_httpd_removed" />
>   <ref nist="CM-6, CM-7" />
>   </Rule>
> +
> +</Group>  <!--<Group id="disabling_httpd">  -->
> +
> +<Group id="installing_httpd">
> +<title>Install Apache if Necessary</title>
> +<description>If<tt>httpd</tt>  was not installed and activated, but the system
> +needs to act as a web server, then it should be installed on the system. Follow these
> +guidelines to install it defensively. The<tt>httpd</tt>  package can be installed with
> +the following command:
> +<pre># yum install httpd</pre>
> +This method of installation is recommended over installing the "Web Server" package group
> +during the system installation process. The Web Server package group inscludes many packages
> +which are likely extraneous, while the command-line method installs only the required<tt>httpd</tt>
> +package itself.
> +</description>
> +<!--<ident cce="4346-3" />-->
> +<!--<oval id="package_httpd_installed" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +
> +<Group id="httpd_minimal_modules_installed">

In input/services/http.xml we have
<group id="http">
<group id=disabling_httpd"></...>
<group id=installing_httpd"></...>
</...>

Shouldn't httpd_minimal_modules_installed by a <rule> not a <group>? See 
this in a few places of this patch.

> +<title>Confirm Minimal Built-in Modules Installed</title>
> +<description>The default<tt>httpd</tt>  installation minimizes the number of
> +modules that are compiled directly into the binary (<tt>core prefork http_core
> +mod_so</tt>). This minimizes risk by limiting the capabilities allowed by the
> +webserver.
> +
> +Query the set of compiled-in modules using the following command:
> +<pre>$ httpd -l</pre>
> +If the number of compiled-in modules is significantly larger than the
> +aforementioned set, this guide recommends reinstallating<tt>httpd</tt>  with a
> +reduced configuration. Minimizing the number of modules that are compiled into
> +the<tt>httpd</tt>  binary, reduces risk by limiting the capabilities allowed by
> +the webserver.
> +</description>

Early we told the user to 'yum install httpd' which implies "use the 
version the vendor ships." If that version is to bloated I'd argue we 
should open a bug/ticket with the vendor rather than tell the users to 
re-compile apache (and lose all vendor support).


> +
> +</Group>  <!--<Group id="httpd_minimal_modules_installed">  -->
> +
> +</Group>  <!--<Group id="installing_httpd">  -->
> +
> +<Group id="securing_httpd">
> +<title>Secure Apache Configuration</title>
> +<description>The<tt>httpd</tt>  configuration file is<tt>/etc/httpd/conf/httpd.conf</tt>. Apply
> +the recommendations in the remainder of this section to this file.
> +</description>

I get why securing_httpd should be a parent group, but we still need to 
convert it's child controls to <rule>'s

> +
> +<Group id="httpd_restrict_info_leakage">
> +<title>Restrict Web Server Information Leakage</title>
> +<description>
> +The<tt>ServerTokens</tt>  and<tt>ServerSignature</tt>  directives determine how
> +much information the web server discloses about the configuration of the system.<tt>ServerSignature Off</tt>
> +keeps<tt>httpd</tt>  from displaying the server version on error pages. It is a good security
> +practice to limit the information provided to clients.
> +</description>

Nitpick, I'd remove the language about specifics on ServerSignature. Let 
the group <description> cover the group, not specific rules.

> +
> +<Rule id="httpd_servertokens_prod">
> +<title>Set httpd<tt>ServerTokens</tt>  Directive to<tt>Prod</tt></title>
> +<description>
> +<tt>ServerTokens Prod</tt>  restricts information in page headers, returning only the word "Apache."
> +<br /><br />
> +Add or correct the following directive in<tt>/etc/httpd/conf/httpd.conf</tt>:
> +<pre>ServerTokens Prod</pre>
> +</description>
> +<rationale>
> +Information disclosed to clients about the configuration of the web server and system could be used
> +to plan an attack on the given system. This information disclosure should be restricted to a minimum.
> +</rationale>
> +<ident cce="4474-3" />
> +<oval id="httpd_servertokens_prod" />
> +<ref nist="CM-6, CM-7" />
> +</Rule>
> +
> +<Rule id="httpd_serversignature_off">
> +<title>Set httpd<tt>ServerSignature</tt>  Directive to<tt>Off</tt></title>
> +<description>
> +<tt>ServerSignature Off</tt>  restricts<tt>httpd</tt>  from displaying server version number
> +on error pages.
> +<br /><br />
> +Add or correct the following directive in<tt>/etc/httpd/conf/httpd.conf</tt>:
> +<pre>ServerSignature Off</pre>
> +</description>
> +<rationale>
> +Information disclosed to clients about the configuration of the web server and system could be used
> +to plan an attack on the given system. This information disclosure should be restricted to a minimum.
> +</rationale>
> +<ident cce="3756-4" />
> +<oval id="httpd_serversignature_off" />
> +<ref nist="CM-6, CM-7" />
> +</Rule>
> +
> +</Group>  <!--<Group id="httpd_restrict_info_leakage">  -->
> +
> +<Group id="httpd_minimize_loadable_modules">
> +<title>Minimize Web Server Loadable Modules</title>
> +<description>
> +A default installation of<tt>httpd</tt>  includes a plethora of “dynamically shared objects” (DSO)
> +that are loaded at run-time. Unlike the aforementioned “compiled-in” modules, a DSO can be
> +disabled in the configuration file by removing the corresponding LoadModule directive.
> +<br /><br />
> +Note: A DSO only provides additional functionality if associated directives are included
> +in the<tt>httpd</tt>  configuration file. It should also be noted that removing a DSO will produce
> +errors on<tt>httpd</tt>  startup if the configuration file contains directives that apply to that
> +module. Refer to<tt>http://httpd.apache.org/docs/</tt>  for details on which directives
> +are associated with each DSO.
> +<br /><br />
> +Following each DSO removal, the configuration can be tested with the following command
> +to check if everything still works:
> +<pre># service httpd configtest</pre>
> +The purpose of each of the modules loaded by default will now be addressed one at a time.
> +If none of a module’s directives are being used, remove it.
> +</description>
> +
> +<Group id="httpd_core_modules">
> +<title><tt>httpd</tt>  Core Modules</title>
> +<description>
> +These modules comprise a basic subset of modules that are likely needed for base<tt>httpd</tt>
> +functionality; ensure they are not commented out in<tt>/etc/httpd/conf/httpd.conf</tt>:
> +<pre>LoadModule auth_basic_module modules/mod_auth_basic.so
> +LoadModule authn_default_module modules/mod_authn_default.so
> +LoadModule authz_host_module modules/mod_authz_host.so
> +LoadModule authz_user_module modules/mod_authz_user.so
> +LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
> +LoadModule authz_default_module modules/mod_authz_default.so
> +LoadModule log_config_module modules/mod_log_config.so
> +LoadModule logio_module modules/mod_logio.so
> +LoadModule setenvif_module modules/mod_setenvif.so
> +LoadModule mime_module modules/mod_mome.so
> +LoadModule autoindex_module modules/mod_autoindex.so
> +LoadModule negotiation_module modules/mod_negotiation.so
> +LoadModule dir_module modules/mod_dir.so
> +LoadModule alias_module modules/mod_alias.so</pre>
> +Minimizing the number of loadable modules available to the web server, reduces risk
> +by limiting the capabilities allowed by the web server.
> +</description>
> +
> +<Group id="httpd_basic_authentication">
> +<title>Minimize Modules for HTTP Basic Authentication</title>
> +<description>
> +The following modules are necessary if this web server will provide content that will
> +be restricted by a password.
> +<br /><br />
> +Authentication can be performed using local plain text password files (<tt>authn_file</tt>),
> +local DBM password files (<tt>authn_dbm</tt>) or an LDAP directory. The only module required by
> +the web server depends on your choice of authentication. Comment out the modules you don’t
> +need from the following:
> +<pre>LoadModule authn_file_module modules/mod_authn_file.so
> +LoadModule authn_dbm_module modules/mod_authn_dbm.so</pre>
> +<tt>authn_alias</tt>  allows for authentication based on aliases.<tt>authn_anon</tt>
> +allows anonymous authentication similar to that of anonymous ftp sites.<tt>authz_owner</tt>
> +allows authorization based on file ownership.<tt>authz_dbm</tt>  allows for authorization
> +based on group membership if the web server is using DBM authentication.
> +<br /><br />
> +If the above functionality is unnecessary, comment out the related module:
> +<pre>#LoadModule authn_alias_module modules/mod_authn_alias.so
> +#LoadModule authn_anon_module modules/mod_authn_anon.so
> +#LoadModule authz_owner_module modules/mod_authz_owner.so
> +#LoadModule authz_dbm_module modules/mod_authz_dbm.so</pre>
> +</description>
> +<!--<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>-->
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_basic_authentication" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
>   </Group>
> +
> +<Rule id="httpd_digest_authentication">
> +<title>Disable HTTP Digest Authentication</title>
> +<description>
> +The<tt>auth_digest</tt>  module provides encrypted authentication sessions.
> +If this functionality is unnecessary, comment out the related module:
> +<pre>#LoadModule auth_digest_module modules/mod_auth_digest.so</pre>
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_digest_authentication" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>


If there is a method to encrypt authenticated sessions, why would we not 
recommend it's use (vs making optional)?


> +
> +<Rule id="httpd_mod_rewrite">
> +<title>Disable HTTP mod_rewrite</title>
> +<description>
> +The<tt>mod_rewrite</tt>  module is very powerful and can protect against
> +certain classes of web attacks. However, it is also very complex and has a
> +significant history of vulnerabilities itself.  If its functionality is
> +unnecessary, comment out the related module:
> +<pre>#LoadModule rewrite_module modules/mod_rewrite.so</pre>
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_mod_rewrite" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_ldap_support">
> +<title>Disable LDAP Support</title>
> +<description>
> +The<tt>ldap</tt>  module provides HTTP authentication via an LDAP directory.
> +If its functionality is unnecessary, comment out the related modules:
> +<pre>#LoadModule ldap_module modules/mod_ldap.so
> +#LoadModule authnz_ldap_module modules/mod_authnz_ldap.so</pre>
> +If LDAP is to be used, SSL encryption should be used as well.
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_ldap_support" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_server_side_includes">
> +<title>Disable Server Side Includes</title>
> +<description>
> +Server Side Includes provide a method of dynamically generating web pages through the
> +insertion of server-side code. However, the technology is also deprecated and
> +introduces significant security concerns.
> +If this functionality is unnecessary, comment out the related module:
> +<pre>#LoadModule include_module modules/mod_include.so</pre>
> +If there is a critical need for Server Side Includes, they should be enabled with the
> +option<tt>IncludesNoExec</tt>  to prevent arbitrary code execution. Additionally, user
> +supplied data should be encoded to prevent cross-site scripting vulnerabilities.
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_server_side_includes" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_mime_magic">
> +<title>Disable MIME Magic</title>
> +<description>
> +The<tt>mime_magic</tt>  module provides a second layer of MIME support that in most configurations
> +is likely extraneous.  If its functionality is unnecessary, comment out the related module:
> +<pre>#LoadModule mime_magic_module modules/mod_mime_magic.so</pre>
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_mime_magic" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_webdav">
> +<title>Disable WebDAV (Distributed Authoring and Versioning)</title>
> +<description>
> +WebDAV is an extension of the HTTP protocol that provides distributed and
> +collaborative access to web content.  If its functionality is unnecessary,
> +comment out the related modules:
> +<pre>#LoadModule dav_module modules/mod_dav.so
> +#LoadModule dav_fs_module modules/mod_dav_fs.so</pre>
> +If there is a critical need for WebDAV, extra care should be taken in its configuration.
> +Since DAV access allows remote clients to manipulate server files, any location on the
> +server that is DAV enabled should be protected by access controls.
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server, reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_webdav" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_server_activity_status">
> +<title>Disable Server Activity Status</title>
> +<description>
> +The<tt>status</tt>  module provides real-time access to statistics on the internal operation of
> +the web server. This may constitute an unnecessary information leak and should be disabled
> +unless necessary.  To do so, comment out the related module:
> +<pre>#LoadModule status_module modules/mod_status.so</pre>
> +If there is a critical need for this module, ensure that access to the status
> +page is properly restricted to a limited set of hosts in the status handler
> +configuration.
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_server_activity_status" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_server_configuration_display">
> +<title>Disable Web Server Configuration Display</title>
> +<description>
> +The<tt>info</tt>  module creates a web page illustrating the configuration of the web server. This
> +can create an unnecessary security leak and should be disabled.
> +If its functionality is unnecessary, comment out the module:
> +<pre>#LoadModule info_module modules/mod_info.so</pre>
> +If there is a critical need for this module, use the<tt>Location</tt>  directive to provide
> +an access control list to restrict access to the information.
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_server_configuration_display" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_url_correction">
> +<title>Disable URL Correction on Misspelled Entries</title>
> +<description>
> +The<tt>speling</tt>  module attempts to find a document match by allowing one misspelling in an
> +otherwise failed request. If this functionality is unnecessary, comment out the module:
> +<pre>#LoadModule speling_module modules/mod_speling.so</pre>
> +This functionality weakens server security by making site enumeration easier.
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_url_correction" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_proxy_support">
> +<title>Disable Proxy Support</title>
> +<description>
> +The<tt>proxy</tt>  module provides proxying support, allowing<tt>httpd</tt>  to forward requests and
> +serve as a gateway for other servers.  If its functionality is unnecessary, comment out the module:
> +<pre>#LoadModule proxy_module modules/mod_proxy.so</pre>
> +<!-- dependencies: #LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
> +#LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
> +#LoadModule proxy_http_module modules/mod_proxy_http.so
> +#LoadModule proxy_connect_module modules/mod_proxy_connect.so-->
> +If proxy support is needed, load<tt>mod_proxy</tt>  and the appropriate proxy protocol handler
> +module (one of<tt>mod_proxy_http</tt>,<tt>mod_proxy_ftp</tt>, or<tt>mod_proxy_connect</tt>). Additionally,
> +make certain that a server is secure before enabling proxying, as open proxy servers
> +are a security risk.<tt>mod_proxy_balancer</tt>  enables load balancing, but requires that
> +<tt>mod status</tt>  be enabled.
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_proxy_support" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_cache_support">
> +<title>Disable Cache Support</title>
> +<description>
> +The<tt>cache</tt>  module allows<tt>httpd</tt>  to cache data, optimizing access to
> +frequently accessed content.  However, it introduces potential security flaws
> +such as the possibility of circumventing<tt>Allow</tt>  and
> +<tt>Deny</tt>  directives.
> +<br /><br />  If this functionality is
> +unnecessary, comment out the module:
> +<pre>#LoadModule cache_module modules/mod_cache.so</pre>
> +If caching is required, it should not be enabled for any limited-access content.
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_cache_support" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_cgi_support">
> +<title>Disable CGI Support</title>
> +<description>
> +The<tt>cgi</tt>  module allows HTML to interact with the CGI web programming language.
> +<br /><br />
> +If this functionality is unnecessary, comment out the module:
> +<pre>#LoadModule cgi_module modules/mod_cgi.so</pre>
> +<!--#LoadModule env_module modules/mod_env.so
> +#LoadModule actions_module modules/mod_actions.so
> +#LoadModule suexec_module modules/mod_suexec.so -->
> +If the web server requires the use of CGI, enable<tt>mod_cgi</tt>.
> +<!-- If extended
> +CGI functionality is required, include the appropriate modules.<tt>env</tt>  allows for
> +control of the environment passed to CGI scripts.<tt>actions</tt>  allows CGI events
> +to be triggered when files of a certain type are requested.<tt>su exec</tt>  allows
> +CGI scripts to run as a specified user/group instead of as the server’s user/group. -->
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_cgi_support" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Group id="httpd_optional_components">
> +<title>Minimize Various Optional Components</title>
> +<description>
> +The following modules perform very specific tasks, sometimes providing access to
> +just a few additional directives. If such functionality is not required (or if you
> +are not using these directives), comment out the associated module:
> +<ul>
> +<li>External filtering (response passed through external program prior to client delivery)
> +<pre>#LoadModule ext_filter_module modules/mod_ext_filter.so</pre></li>
> +<li>User-specified Cache Control and Expiration
> +<pre>#LoadModule expires_module modules/mod_expires.so</pre></li>
> +<li>Compression Output Filter (provides content compression prior to client delivery)
> +<pre>#LoadModule deflate_module modules/mod_deflate.so</pre></li>
> +<li>HTTP Response/Request Header Customization
> +<pre>#LoadModule headers_module modules/mod_headers.so</pre></li>
> +<li>User activity monitoring via cookies
> +<pre>#LoadModule usertrack_module modules/mod_usertrack.so</pre></li>
> +<li>Dynamically configured mass virtual hosting
> +<pre>#LoadModule vhost_alias_module modules/mod_vhost_alias.so</pre></li>
> +</ul>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</description>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_optional_components" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Group>
> +
> +<Group id="httpd_minimize_config_files_included">
> +<title>Minimize Configuration Files Included</title>
> +<description>
> +The<tt>Include</tt>  directive directs<tt>httpd</tt>  to load supplementary configuration files
> +from a provided path. The default configuration loads all files that end in<tt>.conf</tt>
> +from the<tt>/etc/httpd/conf.d</tt>  directory.
> +<br /><br />
> +To restrict excess configuration, the following line should be commented out and
> +replaced with<tt>Include</tt>  directives that only reference required configuration files:
> +<pre>#Include conf.d/*.conf</pre>
> +If the above change was made, ensure that the SSL encryption remains loaded by
> +explicitly including the corresponding configuration file:
> +<pre>Include conf.d/ssl.conf</pre>
> +If PHP is necessary, a similar alteration must be made:
> +<pre>Include conf.d/php.conf</pre>
> +</description>
> +<!--<rationale>-->
> +Explicitly listing the configuration files to be loaded during web server start-up avoids
> +the possibility of unwanted or malicious configuration files to be automatically included as
> +part of the server's running configuration.
> +<!--</rationale>-->
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_minimize_config_files_included" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
>   </Group>
>
> +</Group>  <!--<Group id="httpd_core_modules">  -->
> +
> +</Group>  <!--<Group id="httpd_minimize_loadable_modules">  -->
> +
> +<Group id="httpd_directory_restrictions">
> +<title>Directory Restrictions</title>
> +<description>
> +The Directory tags in the web server configuration file allow finer grained access
> +control for a specified directory. All web directories should be configured on a
> +case-by-case basis, allowing access only where needed.
> +</description>
> +
> +<Rule id="httpd_restrict_root_directory">
> +<title>Restrict Root Directory</title>
> +<description>
> +The<tt>httpd</tt>  root directory should always have the most restrictive configuration enabled.
> +<pre>&lt;Directory /&gt;
> +   Options None
> +   AllowOverride None
> +   Order allow,deny
> +&lt;/Directory&gt;</pre>
> +</description>
> +<rationale>
> +The Web Server's root directory content should be protected from unauthorized access
> +by web clients.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_restrict_root_directory" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_restrict_web_directory">
> +<title>Restrict Web Directory</title>
> +<description>
> +The default configuration for the web (<tt>/var/www/html</tt>) Directory allows directory
> +indexing (<tt>Indexes</tt>) and the following of symbolic links (<tt>FollowSymLinks</tt>).
> +Neither of these is recommended.
> +<br /><br />
> +The<tt>/var/www/html</tt>  directory hierarchy should not be viewable via the web, and
> +symlinks should only be followed if the owner of the symlink also owns the linked file.
> +<br /><br />
> +Ensure that this policy is adhered to by altering the related section of the configuration:
> +<pre>&lt;Directory "/var/www/html"&gt;
> +#  ...
> +   Options SymLinksIfOwnerMatch
> +#  ...
> +&lt;/Directory&gt;</pre>
> +</description>
> +<rationale>
> +Access to the web server's directory hierarchy could allow access to unauthorized files
> +by web clients. Following symbolic links could also allow such access.
> +</rationale>


As an aside, if the default settings of applications are not sane we 
should open up tickets with the vendor (that feels weird to say, since I 
work for one of them...). I'll skim through this patch later review for 
such things.



> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_restrict_web_directory" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_restrict_critical_directories">
> +<title>Restrict Other Critical Directories</title>
> +<description>
> +All accessible web directories should be configured with similarly restrictive settings.
> +The<tt>Options</tt>  directive should be limited to necessary functionality and the<tt>AllowOverride</tt>
> +directive should be used only if needed. The<tt>Order</tt>  and<tt>Deny</tt>  access control tags
> +should be used to deny access by default, allowing access only where necessary.
> +</description>
> +<rationale>
> +Directories accessible from a web client should be configured with the least amount of
> +access possible in order to avoid unauthorized access to restricted content or server information.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_restrict_critical_directories" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_limit_available_methods">
> +<title>Limit Available Methods</title>
> +<description>
> +Web server methods are defined in section 9 of RFC 2616 (http://www.ietf.org/rfc/rfc2616.txt).
> +If a web server does not require the implementation of all available methods,
> +they should be disabled.
> +<br /><br />
> +Note:<tt>GET</tt>  and<tt>POST</tt>  are the most common methods. A majority of the others
> +are limited to the WebDAV protocol.
> +<pre>&lt;Directory /var/www/html&gt;
> +# ...
> +   # Only allow specific methods (this command is case-sensitive!)
> +&lt;LimitExcept GET POST&gt;
> +      Order allow,deny
> +&lt;/LimitExcept&gt;
> +# ...
> +&lt;/Directory&gt;</pre>
> +</description>
> +<rationale>
> +Minimizing the number of available methods to the web client reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_limit_available_methods" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +</Group>  <!--<Group id="httpd_directory_restrictions">  -->
> +
> +<Group id="httpd_modules_improve_security">
> +<title>Use Appropriate Modules to Improve<tt>httpd</tt>'s Security</title>
> +<description>
> +Among the modules available for<tt>httpd</tt>  are several whose use may improve the
> +security of the web server installation. This section recommends and discusses
> +the deployment of security-relevant modules.
> +</description>
> +
> +<Group id="httpd_deploy_mod_ssl">
> +<title>Deploy<tt>mod_ssl</tt></title>
> +<description>
> +Because HTTP is a plain text protocol, all traffic is susceptible to passive
> +monitoring. If there is a need for confidentiality, SSL should be configured
> +and enabled to encrypt content.
> +<br /><br />
> +Note:<tt>mod_nss</tt>  is a FIPS 140-2 certified alternative to<tt>mod_ssl</tt>.
> +The modules share a considerable amount of code and should be nearly identical
> +in functionality. If FIPS 140-2 validation is required, then<tt>mod_nss</tt>  should
> +be used. If it provides some feature or its greater compatibility is required,
> +then<tt>mod_ssl</tt>  should be used.
> +</description>
> +
> +<Rule id="httpd_install_mod_ssl">
> +<title>Install<tt>mod_ssl</tt></title>
> +<description>
> +Install the<tt>mod_ssl</tt>  module:
> +<pre># yum install mod_ssl</pre>
> +</description>
> +<rationale>
> +<tt>mod_ssl</tt>  provides encryption capabilites for the<tt>httpd</tt>  Web server. Unencrypted
> +content is transmitted in plain text which could be passively monitored and accessed by
> +unauthorized parties.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<oval id="package_mod_ssl_installed" />
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +</Group>  <!--<Group id="httpd_deploy_mod_ssl">  -->
> +
> +<Group id="httpd_deploy_mod_security">
> +<title>Deploy<tt>mod_security</tt></title>
> +<description>
> +The<tt>security</tt>  module provides an application level firewall for<tt>httpd</tt>.
> +Following its installation with the base ruleset, specific configuration advice can be found at
> +http://www.modsecurity.org/ to design a policy that best matches the security needs of
> +the web applications.
> +</description>
> +
> +<Rule id="httpd_install_mod_security">
> +<title>Install<tt>mod_security</tt></title>
> +<description>
> +Install the<tt>security</tt>  module:
> +<pre># yum install mod_security</pre>
> +<!-- This is in EPEL and might be out of scope as a Rule. (?) -->

Good call. Perhaps we could clearly state this about this module. i.e.

The usage of httpd_deploy_mod_security is highly recommended. It should 
be noted this module does not ship within the base Enterprise Linux 
content, and instead is provided via Extra Packages for Enterprise Linux 
(EPEL). For more information on EPEL please refer to 
http://fedoraproject.org/wiki/EPEL.


> +</description>
> +<rationale>
> +<tt>mod_security</tt>  provides an additional level of protection for the web server by
> +enabling the administrator to implement content access policies and filters at the
> +application layer.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<oval id="package_mod_security_installed" />
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +</Group>  <!--<Group id="httpd_deploy_mod_security">  -->
> +
> +</Group>  <!--<Group id="httpd_modules_improve_security">  -->
> +
> +<Group id="httpd_use_dos_protection_modules">
> +<title>Use Denial-of-Service Protection Modules</title>
> +<description>
> +Denial-of-service attacks are difficult to detect and prevent while maintaining
> +acceptable access to authorized users. However, some traffic-shaping
> +modules can be used to address the problem. Well-known DoS protection modules include:
> +<pre>mod_cband mod_bwshare mod_limitipconn mod_evasive</pre>
> +Denial-of-service prevention be implemented for a web server if such a threat exists.
> +However, specific configuration details are very dependent on the environment and often best left
> +at the discretion of the administrator.
> +</description>
> +</Group>  <!--<Group id="httpd_use_dos_protection_modules">  -->

<group> tags without a <rule> mean this should be a <rule>. Why can't 
this be a rule under <Group id="securing_httpd"> ? This applies to a few 
of these....

> +
> +<Group id="httpd_configure_php_securely">
> +<title>Configure PHP Securely</title>
> +<description>
> +PHP is a widely-used and often misconfigured server-side scripting language. It should
> +be used with caution, but configured appropriately when needed.
> +<br /><br />
> +Review<tt>/etc/php.ini</tt>  and make the following changes if possible:

I can understand why this would be a <group>, but do think the various 
config options should be <rule>'s

> +<pre># Do not expose PHP error messages to external users
> +display_errors = Off
> +
> +# Enable safe mode
> +safe_mode = On
> +
> +# Only allow access to executables in isolated directory
> +safe_mode_exec_dir = php-required-executables-path
> +
> +# Limit external access to PHP environment
> +safe_mode_allowed_env_vars = PHP_
> +
> +# Restrict PHP information leakage
> +expose_php = Off
> +
> +# Log all errors
> +log_errors = On
> +
> +# Do not register globals for input data
> +register_globals = Off
> +
> +# Minimize allowable PHP post size
> +post_max_size = 1K
> +
> +# Ensure PHP redirects appropriately
> +cgi.force_redirect = 0
> +
> +# Disallow uploading unless necessary
> +file_uploads = Off
> +
> +# Disallow treatment of file requests as fopen calls
> +allow_url_fopen = Off
> +
> +# Enable SQL safe mode
> +sql.safe_mode = On
> +</pre>
> +</description>
> +
> +</Group>  <!--<Group id="httpd_configure_php_securely">  -->
> +
> +<Group id="httpd_configure_os_protect_web_server">
> +<title>Configure Operating System to Protect Web Server</title>
> +<description>
> +The following configuration steps should be taken on the machine which hosts the
> +web server, in order to provide as safe an environment as possible for the web server.
> +</description>
> +
> +<Group id="httpd_restrict_file_dir_access">
> +<title>Restrict File and Directory Access</title>
> +<description>
> +Minimize access to critical<tt>httpd</tt>  files and directories.
> +</description>
> +
> +<Rule id="httpd_logs_permissions">
> +<title>Set Permissions on the<tt>/var/log/httpd/</tt>  Directory</title>
> +<description>
> +Ensure that the permissions on the web server log directory is set to 700:
> +<pre># chmod 700 /var/log/httpd/</pre>
> +This is its default setting.
> +</description>
> +<rationale>
> +Access to the web server's log files may allow an unauthorized user or attacker
> +to access information about the web server or alter the server's log files.
> +</rationale>
> +<ident cce="4574-0" />
> +<oval id="dir_perms_var_log_httpd" />
> +<ref nist="CM-6, CM-7" />
> +</Rule>
> +
> +<Rule id="httpd_conf_dir_permissions">
> +<title>Set Permissions on the<tt>/etc/httpd/conf/</tt>  Directory</title>
> +<description>
> +Set permissions on the web server configuration directory to 750:
> +<pre># chmod 750 /etc/httpd/conf/</pre>
> +</description>
> +<rationale>
> +Access to the web server's configuration files may allow an unauthorized user or attacker
> +to access information about the web server or alter the server's configuration files.
> +</rationale>
> +<!--<ident cce="4574-0" />  -->
> +<oval id="dir_perms_etc_httpd_conf" />
> +<!--<ref nist="CM-6, CM-7" />  -->
> +</Rule>
> +
> +<Rule id="httpd_conf_files_permissions">
> +<title>Set Permissions on All Configuration Files Inside<tt>/etc/httpd/conf/</tt></title>
> +<description>
> +Set permissions on the web server configuration files to 640:
> +<pre># chmod 640 /etc/httpd/conf/*</pre>
> +</description>
> +<rationale>
> +Access to the web server's configuration files may allow an unauthorized user or attacker
> +to access information about the web server or to alter the server's configuration files.
> +</rationale>
> +<ident cce="4386-9" />
> +<oval id="file_permissions_httpd_server_conf_files" />
> +<ref nist="CM-6, CM-7" />
> +</Rule>
> +
> +</Group>  <!--<Group id="httpd_restrict_file_dir_access">  -->
> +
> +<Group id="httpd_configure_iptables">
> +<title>Configure<tt>iptables</tt>  to Allow Access to the Web Server</title>
> +<description>
> +By default,<tt>iptables</tt>  blocks access to the ports used by the web server.
> +To configure<tt>iptables</tt>  to allow port 80 traffic edit<tt>/etc/sysconfig/iptables</tt>.
> +Add the following line, ensuring that it appears before the final LOG and DROP lines for
> +the RH-Firewall-1-INPUT chain:
> +<pre>-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT</pre>
> +To configure<tt>iptables</tt>  to allow port 443 traffic edit<tt>/etc/sysconfig/iptables</tt>.
> +Add the following line, ensuring that it appears before the final LOG and DROP lines for
> +the RH-Firewall-1-INPUT chain:
> +<pre>-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT</pre>
> +</description>
> +
> +</Group>  <!--<Group id="httpd_configure_iptables">  -->
> +
> +<Group id="httpd_chroot">
> +<title>Run<tt>httpd</tt>  in a<tt>chroot</tt>  Jail if Practical</title>
> +<description>
> +Running<tt>httpd</tt>  inside a<tt>chroot</tt>  jail
> +is designed to isolate the web server process to a small section of the filesystem,
> +limiting the damage if it is compromised.
> +Versions of Apache greater than 2.2.10 (such as the one included with RHEL 6) provide
> +the<tt>ChrootDir</tt>  directive.
> +To run Apache inside a chroot jail in<tt>/chroot/apache</tt>, add the following
> +line to<tt>/etc/httpd/conf/httpd.conf</tt>:
> +<pre>ChrootDir /chroot/apache</pre>
> +This necessitates placing all files required by<tt>httpd</tt>  inside
> +<tt>/chroot/apache</tt>  , including<tt>httpd</tt>’s binaries, modules, configuration files, and
> +served web pages. The details of this configuration are beyond the scope of this guide.  This may
> +also require additional SELinux configuration.
> +</description>
> +
> +</Group>  <!--<Group id="httpd_chroot">  -->
> +
> +</Group>  <!--<Group id="httpd_configure_os_protect_web_server">  -->
> +
> +</Group>  <!--<Group id="securing_httpd">  -->
> +
> +</Group>  <!--<Group id="http">  -->


This is a VERY good start. I'd like to see a few checks more;

(1) Verify httpd SELinux module is loaded
(2) Verify selinux type for httpd directories (content, config, etc)
(3) If httpd is removed, verify the selinux module is too (not default 
behavior)


More information about the scap-security-guide mailing list