TMA-APACHE-3.5
Ensure the Group Is Set Correctly on Apache Directories and Files
Beschreibung
The Apache directories and files should be set to have a group Id of root, (or a root equivalent) group. This applies to all of the Apache software directories and files installed. The only expected exception is that the Apache web document root ($APACHE_PREFIX/htdocs) is likely to need a designated group to allow web content to be updated (such as webupdate) through a change management process. Counts files under the ServerRoot (except htdocs) whose group is not root; expects 0. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.
So wird geprüft
Prüfmethode: Shell-Befehl
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; [ -d "$R" ] || exit 1; find "$R" -path "$R/htdocs" -prune -o ! -group root -print 2>/dev/null | wc -l- Erwartete Ausgabe
0
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
chgrp -R root "$APACHE_PREFIX" (excluding htdocs).
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- apacheaccounts
- Referenz
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 3.5 Ensure the Group Is Set Correctly on Apache Directories and Files
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
tmaegis scan --target apache