TMAegis
Weitere Regeln für apache

TMA-APACHE-10.3

Ensure the LimitRequestFieldsize Directive is Set to 8190 or Less

NiedrigStufe 2Automatisiertapache

Beschreibung

The LimitRequestFieldSize limits the number of bytes that will be allowed in an HTTP request header. It is recommended that the LimitRequestFieldSize directive be set to the default value of 8190 or less. LimitRequestFieldSize must be set and every value must be 8190 or less. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

So wird geprüft

Prüfmethode: Shell-Befehl

shell
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk 'tolower($1)=="limitrequestfieldsize"{n++; v=$2+0; if(!(v<=8190)) bad=1} END{print (n>0&&!bad)?"compliant":"noncompliant"}'
Erwartete Ausgabe
compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Set LimitRequestFieldSize 8190 (or lower). Then run apachectl configtest and reload Apache.

Eigenschaften

Betriebssysteme
Beliebig
Tags
apacherequest-limits
Referenz
CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 10.3 Ensure the LimitRequestFieldsize Directive is Set to 8190 or Less

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell
tmaegis scan --target apache --level 2