TMA-APACHE-10.3
Ensure the LimitRequestFieldsize Directive is Set to 8190 or Less
NiedrigStufe 2Automatisiertapache
Beschreibung
The LimitRequestFieldSize limits the number of bytes that will be allowed in an HTTP request header. It is recommended that the LimitRequestFieldSize directive be set to the default value of 8190 or less. LimitRequestFieldSize must be set and every value must be 8190 or less. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.
So wird geprüft
Prüfmethode: Shell-Befehl
shell
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk 'tolower($1)=="limitrequestfieldsize"{n++; v=$2+0; if(!(v<=8190)) bad=1} END{print (n>0&&!bad)?"compliant":"noncompliant"}'- Erwartete Ausgabe
compliant
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
Set LimitRequestFieldSize 8190 (or lower). Then run apachectl configtest and reload Apache.
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- apacherequest-limits
- Referenz
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 10.3 Ensure the LimitRequestFieldsize Directive is Set to 8190 or Less
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
shell
tmaegis scan --target apache --level 2