[PATCH] significant body of httpd guidance (XCCDF)

Willy Santos wsantos at redhat.com
Fri Apr 27 16:17:11 UTC 2012


ACK

Willy Santos, RHCE
Consultant
Red Hat Consulting
Cell: +1 (301) 254-7077
Email: wsantos at redhat.com


On 04/27/2012 11:49 AM, Jeffrey Blank wrote:
> Signed-off-by: Jeffrey Blank<blank at eclipse.ncsc.mil>
> ---
>   rhel6/src/input/services/http.xml |  789 +++++++++++++++++++++++++++++++++++++
>   1 files changed, 789 insertions(+), 0 deletions(-)
>
> diff --git a/rhel6/src/input/services/http.xml b/rhel6/src/input/services/http.xml
> index 0edea8b..50af842 100644
> --- a/rhel6/src/input/services/http.xml
> +++ b/rhel6/src/input/services/http.xml
> @@ -51,6 +51,795 @@ removing it provides a safeguard against its activation.
>   <oval id="package_httpd_removed" />
>   <ref nist="CM-6, CM-7" />
>   </Rule>
> +
> +</Group>  <!--<Group id="disabling_httpd">  -->
> +
> +<Group id="installing_httpd">
> +<title>Install Apache if Necessary</title>
> +<description>If<tt>httpd</tt>  was not installed and activated, but the system
> +needs to act as a web server, then it should be installed on the system. Follow these
> +guidelines to install it defensively. The<tt>httpd</tt>  package can be installed with
> +the following command:
> +<pre># yum install httpd</pre>
> +This method of installation is recommended over installing the "Web Server"
> +package group during the system installation process. The Web Server package
> +group inscludes many packages which are likely extraneous, while the
> +command-line method installs only the required<tt>httpd</tt>  package itself.
> +</description>
> +<!--<ident cce="4346-3" />-->
> +<!--<oval id="package_httpd_installed" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +
> +<Group id="httpd_minimal_modules_installed">
> +<title>Confirm Minimal Built-in Modules Installed</title>
> +<description>The default<tt>httpd</tt>  installation minimizes the number of
> +modules that are compiled directly into the binary (<tt>core prefork http_core
> +mod_so</tt>). This minimizes risk by limiting the capabilities allowed by the
> +webserver.
> +
> +Query the set of compiled-in modules using the following command:
> +<pre>$ httpd -l</pre>
> +If the number of compiled-in modules is significantly larger than the
> +aforementioned set, this guide recommends reinstallating<tt>httpd</tt>  with a
> +reduced configuration. Minimizing the number of modules that are compiled into
> +the<tt>httpd</tt>  binary, reduces risk by limiting the capabilities allowed by
> +the webserver.
> +</description>
> +
> +</Group>  <!--<Group id="httpd_minimal_modules_installed">  -->
> +
> +</Group>  <!--<Group id="installing_httpd">  -->
> +
> +<Group id="securing_httpd">
> +<title>Secure Apache Configuration</title>
> +<description>The<tt>httpd</tt>  configuration file is
> +<tt>/etc/httpd/conf/httpd.conf</tt>. Apply the recommendations in the remainder
> +of this section to this file.</description>
> +
> +<Group id="httpd_restrict_info_leakage">
> +<title>Restrict Web Server Information Leakage</title>
> +<description>
> +The<tt>ServerTokens</tt>  and<tt>ServerSignature</tt>  directives determine how
> +much information the web server discloses about the configuration of the
> +system.</description>
> +
> +<Rule id="httpd_servertokens_prod">
> +<title>Set httpd<tt>ServerTokens</tt>  Directive to<tt>Prod</tt></title>
> +<description>
> +<tt>ServerTokens Prod</tt>  restricts information in page headers, returning only the word "Apache."
> +<br /><br />
> +Add or correct the following directive in<tt>/etc/httpd/conf/httpd.conf</tt>:
> +<pre>ServerTokens Prod</pre>
> +</description>
> +<rationale>
> +Information disclosed to clients about the configuration of the web server and system could be used
> +to plan an attack on the given system. This information disclosure should be restricted to a minimum.
> +</rationale>
> +<ident cce="4474-3" />
> +<oval id="httpd_servertokens_prod" />
> +<ref nist="CM-6, CM-7" />
> +</Rule>
> +
> +<Rule id="httpd_serversignature_off">
> +<title>Set httpd<tt>ServerSignature</tt>  Directive to<tt>Off</tt></title>
> +<description>
> +<tt>ServerSignature Off</tt>  restricts<tt>httpd</tt>  from displaying server version number
> +on error pages.
> +<br /><br />
> +Add or correct the following directive in<tt>/etc/httpd/conf/httpd.conf</tt>:
> +<pre>ServerSignature Off</pre>
> +</description>
> +<rationale>
> +Information disclosed to clients about the configuration of the web server and system could be used
> +to plan an attack on the given system. This information disclosure should be restricted to a minimum.
> +</rationale>
> +<ident cce="3756-4" />
> +<oval id="httpd_serversignature_off" />
> +<ref nist="CM-6, CM-7" />
> +</Rule>
> +
> +</Group>  <!--<Group id="httpd_restrict_info_leakage">  -->
> +
> +<Group id="httpd_minimize_loadable_modules">
> +<title>Minimize Web Server Loadable Modules</title>
> +<description>
> +A default installation of<tt>httpd</tt>  includes a plethora of dynamically shared objects (DSO)
> +that are loaded at run-time. Unlike the aforementioned compiled-in modules, a DSO can be
> +disabled in the configuration file by removing the corresponding LoadModule directive.
> +<br /><br />
> +Note: A DSO only provides additional functionality if associated directives are included
> +in the<tt>httpd</tt>  configuration file. It should also be noted that removing a DSO will produce
> +errors on<tt>httpd</tt>  startup if the configuration file contains directives that apply to that
> +module. Refer to<tt>http://httpd.apache.org/docs/</tt>  for details on which directives
> +are associated with each DSO.
> +<br /><br />
> +Following each DSO removal, the configuration can be tested with the following command
> +to check if everything still works:
> +<pre># service httpd configtest</pre>
> +The purpose of each of the modules loaded by default will now be addressed one at a time.
> +If none of a module’s directives are being used, remove it.
> +</description>
> +
> +<Group id="httpd_core_modules">
> +<title><tt>httpd</tt>  Core Modules</title>
> +<description>
> +These modules comprise a basic subset of modules that are likely needed for base<tt>httpd</tt>
> +functionality; ensure they are not commented out in<tt>/etc/httpd/conf/httpd.conf</tt>:
> +<pre>LoadModule auth_basic_module modules/mod_auth_basic.so
> +LoadModule authn_default_module modules/mod_authn_default.so
> +LoadModule authz_host_module modules/mod_authz_host.so
> +LoadModule authz_user_module modules/mod_authz_user.so
> +LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
> +LoadModule authz_default_module modules/mod_authz_default.so
> +LoadModule log_config_module modules/mod_log_config.so
> +LoadModule logio_module modules/mod_logio.so
> +LoadModule setenvif_module modules/mod_setenvif.so
> +LoadModule mime_module modules/mod_mome.so
> +LoadModule autoindex_module modules/mod_autoindex.so
> +LoadModule negotiation_module modules/mod_negotiation.so
> +LoadModule dir_module modules/mod_dir.so
> +LoadModule alias_module modules/mod_alias.so</pre>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</description>
> +
> +<Group id="httpd_basic_authentication">
> +<title>Minimize Modules for HTTP Basic Authentication</title>
> +<description>
> +The following modules are necessary if this web server will provide content that will
> +be restricted by a password.
> +<br /><br />
> +Authentication can be performed using local plain text password files (<tt>authn_file</tt>),
> +local DBM password files (<tt>authn_dbm</tt>) or an LDAP directory. The only module required by
> +the web server depends on your choice of authentication. Comment out the modules you don’t
> +need from the following:
> +<pre>LoadModule authn_file_module modules/mod_authn_file.so
> +LoadModule authn_dbm_module modules/mod_authn_dbm.so</pre>
> +<tt>authn_alias</tt>  allows for authentication based on aliases.<tt>authn_anon</tt>
> +allows anonymous authentication similar to that of anonymous ftp sites.<tt>authz_owner</tt>
> +allows authorization based on file ownership.<tt>authz_dbm</tt>  allows for authorization
> +based on group membership if the web server is using DBM authentication.
> +<br /><br />
> +If the above functionality is unnecessary, comment out the related module:
> +<pre>#LoadModule authn_alias_module modules/mod_authn_alias.so
> +#LoadModule authn_anon_module modules/mod_authn_anon.so
> +#LoadModule authz_owner_module modules/mod_authz_owner.so
> +#LoadModule authz_dbm_module modules/mod_authz_dbm.so</pre>
> +</description>
> +<!--<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>-->
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_basic_authentication" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
>   </Group>
> +
> +<Rule id="httpd_digest_authentication">
> +<title>Disable HTTP Digest Authentication</title>
> +<description>
> +The<tt>auth_digest</tt>  module provides encrypted authentication sessions.
> +If this functionality is unnecessary, comment out the related module:
> +<pre>#LoadModule auth_digest_module modules/mod_auth_digest.so</pre>
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_digest_authentication" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_mod_rewrite">
> +<title>Disable HTTP mod_rewrite</title>
> +<description>
> +The<tt>mod_rewrite</tt>  module is very powerful and can protect against
> +certain classes of web attacks. However, it is also very complex and has a
> +significant history of vulnerabilities itself.  If its functionality is
> +unnecessary, comment out the related module:
> +<pre>#LoadModule rewrite_module modules/mod_rewrite.so</pre>
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_mod_rewrite" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_ldap_support">
> +<title>Disable LDAP Support</title>
> +<description>
> +The<tt>ldap</tt>  module provides HTTP authentication via an LDAP directory.
> +If its functionality is unnecessary, comment out the related modules:
> +<pre>#LoadModule ldap_module modules/mod_ldap.so
> +#LoadModule authnz_ldap_module modules/mod_authnz_ldap.so</pre>
> +If LDAP is to be used, SSL encryption should be used as well.
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_ldap_support" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_server_side_includes">
> +<title>Disable Server Side Includes</title>
> +<description>
> +Server Side Includes provide a method of dynamically generating web pages through the
> +insertion of server-side code. However, the technology is also deprecated and
> +introduces significant security concerns.
> +If this functionality is unnecessary, comment out the related module:
> +<pre>#LoadModule include_module modules/mod_include.so</pre>
> +If there is a critical need for Server Side Includes, they should be enabled with the
> +option<tt>IncludesNoExec</tt>  to prevent arbitrary code execution. Additionally, user
> +supplied data should be encoded to prevent cross-site scripting vulnerabilities.
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_server_side_includes" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_mime_magic">
> +<title>Disable MIME Magic</title>
> +<description>
> +The<tt>mime_magic</tt>  module provides a second layer of MIME support that in most configurations
> +is likely extraneous.  If its functionality is unnecessary, comment out the related module:
> +<pre>#LoadModule mime_magic_module modules/mod_mime_magic.so</pre>
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_mime_magic" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_webdav">
> +<title>Disable WebDAV (Distributed Authoring and Versioning)</title>
> +<description>
> +WebDAV is an extension of the HTTP protocol that provides distributed and
> +collaborative access to web content.  If its functionality is unnecessary,
> +comment out the related modules:
> +<pre>#LoadModule dav_module modules/mod_dav.so
> +#LoadModule dav_fs_module modules/mod_dav_fs.so</pre>
> +If there is a critical need for WebDAV, extra care should be taken in its configuration.
> +Since DAV access allows remote clients to manipulate server files, any location on the
> +server that is DAV enabled should be protected by access controls.
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server, reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_webdav" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_server_activity_status">
> +<title>Disable Server Activity Status</title>
> +<description>
> +The<tt>status</tt>  module provides real-time access to statistics on the internal operation of
> +the web server. This may constitute an unnecessary information leak and should be disabled
> +unless necessary.  To do so, comment out the related module:
> +<pre>#LoadModule status_module modules/mod_status.so</pre>
> +If there is a critical need for this module, ensure that access to the status
> +page is properly restricted to a limited set of hosts in the status handler
> +configuration.
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_server_activity_status" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_server_configuration_display">
> +<title>Disable Web Server Configuration Display</title>
> +<description>
> +The<tt>info</tt>  module creates a web page illustrating the configuration of the web server. This
> +can create an unnecessary security leak and should be disabled.
> +If its functionality is unnecessary, comment out the module:
> +<pre>#LoadModule info_module modules/mod_info.so</pre>
> +If there is a critical need for this module, use the<tt>Location</tt>  directive to provide
> +an access control list to restrict access to the information.
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_server_configuration_display" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_url_correction">
> +<title>Disable URL Correction on Misspelled Entries</title>
> +<description>
> +The<tt>speling</tt>  module attempts to find a document match by allowing one misspelling in an
> +otherwise failed request. If this functionality is unnecessary, comment out the module:
> +<pre>#LoadModule speling_module modules/mod_speling.so</pre>
> +This functionality weakens server security by making site enumeration easier.
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_url_correction" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_proxy_support">
> +<title>Disable Proxy Support</title>
> +<description>
> +The<tt>proxy</tt>  module provides proxying support, allowing<tt>httpd</tt>  to forward requests and
> +serve as a gateway for other servers.  If its functionality is unnecessary, comment out the module:
> +<pre>#LoadModule proxy_module modules/mod_proxy.so</pre>
> +<!-- dependencies: #LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
> +#LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
> +#LoadModule proxy_http_module modules/mod_proxy_http.so
> +#LoadModule proxy_connect_module modules/mod_proxy_connect.so-->
> +If proxy support is needed, load<tt>mod_proxy</tt>  and the appropriate proxy protocol handler
> +module (one of<tt>mod_proxy_http</tt>,<tt>mod_proxy_ftp</tt>, or<tt>mod_proxy_connect</tt>). Additionally,
> +make certain that a server is secure before enabling proxying, as open proxy servers
> +are a security risk.<tt>mod_proxy_balancer</tt>  enables load balancing, but requires that
> +<tt>mod status</tt>  be enabled.
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_proxy_support" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_cache_support">
> +<title>Disable Cache Support</title>
> +<description>
> +The<tt>cache</tt>  module allows<tt>httpd</tt>  to cache data, optimizing access to
> +frequently accessed content.  However, it introduces potential security flaws
> +such as the possibility of circumventing<tt>Allow</tt>  and
> +<tt>Deny</tt>  directives.
> +<br /><br />  If this functionality is
> +unnecessary, comment out the module:
> +<pre>#LoadModule cache_module modules/mod_cache.so</pre>
> +If caching is required, it should not be enabled for any limited-access content.
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_cache_support" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_cgi_support">
> +<title>Disable CGI Support</title>
> +<description>
> +The<tt>cgi</tt>  module allows HTML to interact with the CGI web programming language.
> +<br /><br />
> +If this functionality is unnecessary, comment out the module:
> +<pre>#LoadModule cgi_module modules/mod_cgi.so</pre>
> +<!--#LoadModule env_module modules/mod_env.so
> +#LoadModule actions_module modules/mod_actions.so
> +#LoadModule suexec_module modules/mod_suexec.so -->
> +If the web server requires the use of CGI, enable<tt>mod_cgi</tt>.
> +<!-- If extended
> +CGI functionality is required, include the appropriate modules.<tt>env</tt>  allows for
> +control of the environment passed to CGI scripts.<tt>actions</tt>  allows CGI events
> +to be triggered when files of a certain type are requested.<tt>su exec</tt>  allows
> +CGI scripts to run as a specified user/group instead of as the server’s user/group. -->
> +</description>
> +<rationale>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_cgi_support" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Group id="httpd_optional_components">
> +<title>Minimize Various Optional Components</title>
> +<description>
> +The following modules perform very specific tasks, sometimes providing access to
> +just a few additional directives. If such functionality is not required (or if you
> +are not using these directives), comment out the associated module:
> +<ul>
> +<li>External filtering (response passed through external program prior to client delivery)
> +<pre>#LoadModule ext_filter_module modules/mod_ext_filter.so</pre></li>
> +<li>User-specified Cache Control and Expiration
> +<pre>#LoadModule expires_module modules/mod_expires.so</pre></li>
> +<li>Compression Output Filter (provides content compression prior to client delivery)
> +<pre>#LoadModule deflate_module modules/mod_deflate.so</pre></li>
> +<li>HTTP Response/Request Header Customization
> +<pre>#LoadModule headers_module modules/mod_headers.so</pre></li>
> +<li>User activity monitoring via cookies
> +<pre>#LoadModule usertrack_module modules/mod_usertrack.so</pre></li>
> +<li>Dynamically configured mass virtual hosting
> +<pre>#LoadModule vhost_alias_module modules/mod_vhost_alias.so</pre></li>
> +</ul>
> +Minimizing the number of loadable modules available to the web server reduces risk
> +by limiting the capabilities allowed by the web server.
> +</description>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_optional_components" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
>   </Group>
>
> +<Group id="httpd_minimize_config_files_included">
> +<title>Minimize Configuration Files Included</title>
> +<description>
> +The<tt>Include</tt>  directive directs<tt>httpd</tt>  to load supplementary configuration files
> +from a provided path. The default configuration loads all files that end in<tt>.conf</tt>
> +from the<tt>/etc/httpd/conf.d</tt>  directory.
> +<br /><br />
> +To restrict excess configuration, the following line should be commented out and
> +replaced with<tt>Include</tt>  directives that only reference required configuration files:
> +<pre>#Include conf.d/*.conf</pre>
> +If the above change was made, ensure that the SSL encryption remains loaded by
> +explicitly including the corresponding configuration file:
> +<pre>Include conf.d/ssl.conf</pre>
> +If PHP is necessary, a similar alteration must be made:
> +<pre>Include conf.d/php.conf</pre>
> +</description>
> +<!--<rationale>-->
> +Explicitly listing the configuration files to be loaded during web server start-up avoids
> +the possibility of unwanted or malicious configuration files to be automatically included as
> +part of the server's running configuration.
> +<!--</rationale>-->
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_minimize_config_files_included" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Group>
> +
> +</Group>  <!--<Group id="httpd_core_modules">  -->
> +
> +</Group>  <!--<Group id="httpd_minimize_loadable_modules">  -->
> +
> +<Group id="httpd_directory_restrictions">
> +<title>Directory Restrictions</title>
> +<description>
> +The Directory tags in the web server configuration file allow finer grained access
> +control for a specified directory. All web directories should be configured on a
> +case-by-case basis, allowing access only where needed.
> +</description>
> +
> +<Rule id="httpd_restrict_root_directory">
> +<title>Restrict Root Directory</title>
> +<description>
> +The<tt>httpd</tt>  root directory should always have the most restrictive configuration enabled.
> +<pre>&lt;Directory /&gt;
> +   Options None
> +   AllowOverride None
> +   Order allow,deny
> +&lt;/Directory&gt;</pre>
> +</description>
> +<rationale>
> +The Web Server's root directory content should be protected from unauthorized access
> +by web clients.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_restrict_root_directory" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_restrict_web_directory">
> +<title>Restrict Web Directory</title>
> +<description>
> +The default configuration for the web (<tt>/var/www/html</tt>) Directory allows directory
> +indexing (<tt>Indexes</tt>) and the following of symbolic links (<tt>FollowSymLinks</tt>).
> +Neither of these is recommended.
> +<br /><br />
> +The<tt>/var/www/html</tt>  directory hierarchy should not be viewable via the web, and
> +symlinks should only be followed if the owner of the symlink also owns the linked file.
> +<br /><br />
> +Ensure that this policy is adhered to by altering the related section of the configuration:
> +<pre>&lt;Directory "/var/www/html"&gt;
> +#  ...
> +   Options SymLinksIfOwnerMatch
> +#  ...
> +&lt;/Directory&gt;</pre>
> +</description>
> +<rationale>
> +Access to the web server's directory hierarchy could allow access to unauthorized files
> +by web clients. Following symbolic links could also allow such access.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_restrict_web_directory" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_restrict_critical_directories">
> +<title>Restrict Other Critical Directories</title>
> +<description>
> +All accessible web directories should be configured with similarly restrictive settings.
> +The<tt>Options</tt>  directive should be limited to necessary functionality and the<tt>AllowOverride</tt>
> +directive should be used only if needed. The<tt>Order</tt>  and<tt>Deny</tt>  access control tags
> +should be used to deny access by default, allowing access only where necessary.
> +</description>
> +<rationale>
> +Directories accessible from a web client should be configured with the least amount of
> +access possible in order to avoid unauthorized access to restricted content or server information.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_restrict_critical_directories" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +<Rule id="httpd_limit_available_methods">
> +<title>Limit Available Methods</title>
> +<description>
> +Web server methods are defined in section 9 of RFC 2616 (http://www.ietf.org/rfc/rfc2616.txt).
> +If a web server does not require the implementation of all available methods,
> +they should be disabled.
> +<br /><br />
> +Note:<tt>GET</tt>  and<tt>POST</tt>  are the most common methods. A majority of the others
> +are limited to the WebDAV protocol.
> +<pre>&lt;Directory /var/www/html&gt;
> +# ...
> +   # Only allow specific methods (this command is case-sensitive!)
> +&lt;LimitExcept GET POST&gt;
> +      Order allow,deny
> +&lt;/LimitExcept&gt;
> +# ...
> +&lt;/Directory&gt;</pre>
> +</description>
> +<rationale>
> +Minimizing the number of available methods to the web client reduces risk
> +by limiting the capabilities allowed by the web server.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<!--<oval id="httpd_limit_available_methods" />-->
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +</Group>  <!--<Group id="httpd_directory_restrictions">  -->
> +
> +<Group id="httpd_modules_improve_security">
> +<title>Use Appropriate Modules to Improve<tt>httpd</tt>'s Security</title>
> +<description>
> +Among the modules available for<tt>httpd</tt>  are several whose use may improve the
> +security of the web server installation. This section recommends and discusses
> +the deployment of security-relevant modules.
> +</description>
> +
> +<Group id="httpd_deploy_mod_ssl">
> +<title>Deploy<tt>mod_ssl</tt></title>
> +<description>
> +Because HTTP is a plain text protocol, all traffic is susceptible to passive
> +monitoring. If there is a need for confidentiality, SSL should be configured
> +and enabled to encrypt content.
> +<br /><br />
> +Note:<tt>mod_nss</tt>  is a FIPS 140-2 certified alternative to<tt>mod_ssl</tt>.
> +The modules share a considerable amount of code and should be nearly identical
> +in functionality. If FIPS 140-2 validation is required, then<tt>mod_nss</tt>  should
> +be used. If it provides some feature or its greater compatibility is required,
> +then<tt>mod_ssl</tt>  should be used.
> +</description>
> +
> +<Rule id="httpd_install_mod_ssl">
> +<title>Install<tt>mod_ssl</tt></title>
> +<description>
> +Install the<tt>mod_ssl</tt>  module:
> +<pre># yum install mod_ssl</pre>
> +</description>
> +<rationale>
> +<tt>mod_ssl</tt>  provides encryption capabilites for the<tt>httpd</tt>  Web server. Unencrypted
> +content is transmitted in plain text which could be passively monitored and accessed by
> +unauthorized parties.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<oval id="package_mod_ssl_installed" />
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +</Group>  <!--<Group id="httpd_deploy_mod_ssl">  -->
> +
> +<Group id="httpd_deploy_mod_security">
> +<title>Deploy<tt>mod_security</tt></title>
> +<description>
> +The<tt>security</tt>  module provides an application level firewall for<tt>httpd</tt>.
> +Following its installation with the base ruleset, specific configuration advice can be found at
> +http://www.modsecurity.org/ to design a policy that best matches the security needs of
> +the web applications.  Usage of<tt>mod_security</tt>  is highly recommended for some environments,
> +but it should be noted this module does not ship with Red Hat Enterprise Linux itself,
> +and instead is provided via Extra Packages for Enterprise Linux (EPEL).
> +For more information on EPEL please refer to http://fedoraproject.org/wiki/EPEL.
> +</description>
> +
> +<Rule id="httpd_install_mod_security">
> +<title>Install<tt>mod_security</tt></title>
> +<description>
> +Install the<tt>security</tt>  module:
> +<pre># yum install mod_security</pre>
> +<!-- this is in EPEL and this rule should not be included in any RHEL-only baselines -->
> +</description>
> +<rationale>
> +<tt>mod_security</tt>  provides an additional level of protection for the web server by
> +enabling the administrator to implement content access policies and filters at the
> +application layer.
> +</rationale>
> +<!--<ident cce="3756-4" />-->
> +<oval id="package_mod_security_installed" />
> +<!--<ref nist="CM-6, CM-7" />-->
> +</Rule>
> +
> +</Group>  <!--<Group id="httpd_deploy_mod_security">  -->
> +
> +</Group>  <!--<Group id="httpd_modules_improve_security">  -->
> +
> +<Group id="httpd_use_dos_protection_modules">
> +<title>Use Denial-of-Service Protection Modules</title>
> +<description>
> +Denial-of-service attacks are difficult to detect and prevent while maintaining
> +acceptable access to authorized users. However, some traffic-shaping
> +modules can be used to address the problem. Well-known DoS protection modules include:
> +<pre>mod_cband mod_bwshare mod_limitipconn mod_evasive</pre>
> +Denial-of-service prevention should be implemented for a web server if such a threat exists.
> +However, specific configuration details are very dependent on the environment and often best left
> +at the discretion of the administrator.
> +</description>
> +</Group>  <!--<Group id="httpd_use_dos_protection_modules">  -->
> +
> +<Group id="httpd_configure_php_securely">
> +<title>Configure PHP Securely</title>
> +<description>
> +PHP is a widely-used and often misconfigured server-side scripting language. It should
> +be used with caution, but configured appropriately when needed.
> +<br /><br />
> +Review<tt>/etc/php.ini</tt>  and make the following changes if possible:
> +<pre># Do not expose PHP error messages to external users
> +display_errors = Off
> +
> +# Enable safe mode
> +safe_mode = On
> +
> +# Only allow access to executables in isolated directory
> +safe_mode_exec_dir = php-required-executables-path
> +
> +# Limit external access to PHP environment
> +safe_mode_allowed_env_vars = PHP_
> +
> +# Restrict PHP information leakage
> +expose_php = Off
> +
> +# Log all errors
> +log_errors = On
> +
> +# Do not register globals for input data
> +register_globals = Off
> +
> +# Minimize allowable PHP post size
> +post_max_size = 1K
> +
> +# Ensure PHP redirects appropriately
> +cgi.force_redirect = 0
> +
> +# Disallow uploading unless necessary
> +file_uploads = Off
> +
> +# Disallow treatment of file requests as fopen calls
> +allow_url_fopen = Off
> +
> +# Enable SQL safe mode
> +sql.safe_mode = On
> +</pre>
> +</description>
> +
> +</Group>  <!--<Group id="httpd_configure_php_securely">  -->
> +
> +<Group id="httpd_configure_os_protect_web_server">
> +<title>Configure Operating System to Protect Web Server</title>
> +<description>
> +The following configuration steps should be taken on the machine which hosts the
> +web server, in order to provide as safe an environment as possible for the web server.
> +</description>
> +
> +<Group id="httpd_restrict_file_dir_access">
> +<title>Restrict File and Directory Access</title>
> +<description>
> +Minimize access to critical<tt>httpd</tt>  files and directories.
> +</description>
> +
> +<Rule id="httpd_logs_permissions">
> +<title>Set Permissions on the<tt>/var/log/httpd/</tt>  Directory</title>
> +<description>
> +Ensure that the permissions on the web server log directory is set to 700:
> +<pre># chmod 700 /var/log/httpd/</pre>
> +This is its default setting.
> +</description>
> +<rationale>
> +Access to the web server's log files may allow an unauthorized user or attacker
> +to access information about the web server or alter the server's log files.
> +</rationale>
> +<ident cce="4574-0" />
> +<oval id="dir_perms_var_log_httpd" />
> +<ref nist="CM-6, CM-7" />
> +</Rule>
> +
> +<Rule id="httpd_conf_dir_permissions">
> +<title>Set Permissions on the<tt>/etc/httpd/conf/</tt>  Directory</title>
> +<description>
> +Set permissions on the web server configuration directory to 750:
> +<pre># chmod 750 /etc/httpd/conf/</pre>
> +</description>
> +<rationale>
> +Access to the web server's configuration files may allow an unauthorized user or attacker
> +to access information about the web server or alter the server's configuration files.
> +</rationale>
> +<!--<ident cce="4574-0" />  -->
> +<oval id="dir_perms_etc_httpd_conf" />
> +<!--<ref nist="CM-6, CM-7" />  -->
> +</Rule>
> +
> +<Rule id="httpd_conf_files_permissions">
> +<title>Set Permissions on All Configuration Files Inside<tt>/etc/httpd/conf/</tt></title>
> +<description>
> +Set permissions on the web server configuration files to 640:
> +<pre># chmod 640 /etc/httpd/conf/*</pre>
> +</description>
> +<rationale>
> +Access to the web server's configuration files may allow an unauthorized user or attacker
> +to access information about the web server or to alter the server's configuration files.
> +</rationale>
> +<ident cce="4386-9" />
> +<oval id="file_permissions_httpd_server_conf_files" />
> +<ref nist="CM-6, CM-7" />
> +</Rule>
> +
> +</Group>  <!--<Group id="httpd_restrict_file_dir_access">  -->
> +
> +<Group id="httpd_configure_iptables">
> +<title>Configure<tt>iptables</tt>  to Allow Access to the Web Server</title>
> +<description>
> +By default,<tt>iptables</tt>  blocks access to the ports used by the web server.
> +To configure<tt>iptables</tt>  to allow port 80 traffic edit<tt>/etc/sysconfig/iptables</tt>.
> +Add the following line, ensuring that it appears before the final LOG and DROP lines for
> +the RH-Firewall-1-INPUT chain:
> +<pre>-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT</pre>
> +To configure<tt>iptables</tt>  to allow port 443 traffic edit<tt>/etc/sysconfig/iptables</tt>.
> +Add the following line, ensuring that it appears before the final LOG and DROP lines for
> +the RH-Firewall-1-INPUT chain:
> +<pre>-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT</pre>
> +</description>
> +
> +</Group>  <!--<Group id="httpd_configure_iptables">  -->
> +
> +<Group id="httpd_chroot">
> +<title>Run<tt>httpd</tt>  in a<tt>chroot</tt>  Jail if Practical</title>
> +<description>
> +Running<tt>httpd</tt>  inside a<tt>chroot</tt>  jail is designed to isolate the
> +web server process to a small section of the filesystem, limiting the damage if
> +it is compromised.  Versions of Apache greater than 2.2.10 (such as the one
> +included with RHEL 6) provide the<tt>ChrootDir</tt>  directive.  To run Apache
> +inside a chroot jail in<tt>/chroot/apache</tt>, add the following line to
> +<tt>/etc/httpd/conf/httpd.conf</tt>:<pre>ChrootDir /chroot/apache</pre>  This
> +necessitates placing all files required by<tt>httpd</tt>  inside
> +<tt>/chroot/apache</tt>  , including<tt>httpd</tt>'s binaries, modules,
> +configuration files, and served web pages. The details of this configuration
> +are beyond the scope of this guide.  This may also require additional SELinux
> +configuration.
> +</description>
> +
> +</Group>  <!--<Group id="httpd_chroot">  -->
> +
> +</Group>  <!--<Group id="httpd_configure_os_protect_web_server">  -->
> +
> +</Group>  <!--<Group id="securing_httpd">  -->
> +
> +</Group>  <!--<Group id="http">  -->
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/scap-security-guide
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120427/e55067bc/attachment-0001.html>


More information about the scap-security-guide mailing list