Ensure Access to OS Root Directory Is Denied By Default

HochStufe 1Automatisiertapache

Beschreibung

The Apache Directory directive allows for directory specific configuration of access controls and many other features and options. One important usage is to create a default deny policy that does not allow access to operating system directories and files, except for those specifically allowed. This is done by denying access to the OS root directory. The <Directory /> block must contain a single "Require all denied" and no Allow/Deny (or the legacy Order deny,allow + Deny from all with no Allow/Require). Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk '{l=tolower($0); $0=l} /^<directory[[:space:]]/{dd++; if(dd==1){x=$2; gsub(/[">]/,"",x); r=(x=="/"); if(r) f=1}; next} /^<\/directory>/{dd--; if(dd==0) r=0; next} r && $1=="require"{nr++; if($0~/^require[[:space:]]+all[[:space:]]+denied/) rd++} r && $1=="allow"{al++} r && $1=="deny"{dn++; if($0~/from[[:space:]]+all/) dfa=1} r && $1=="order"{no++; if($0~/deny,[[:space:]]*allow/) oda=1} END{print (f && ((nr==1&&rd==1&&al==0&&dn==0) || (no==1&&oda&&dfa&&al==0&&nr==0)))?"compliant":"noncompliant"}'

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

In the main configuration: <Directory /> ... Require all denied ... </Directory> (remove Allow/Deny/other Require lines). Then run apachectl configtest and reload Apache.

Eigenschaften

Betriebssysteme: Beliebig
Tags: apacheaccess-control
Referenz: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 4.1 Ensure Access to OS Root Directory Is Denied By Default

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target apache