TMAegis
Weitere Regeln für apache

TMA-APACHE-4.4

Ensure OverRide Is Disabled for All Directories

MittelStufe 1Automatisiertapache

Beschreibung

The Apache AllowOverride directive and the new AllowOverrideList directive allow for .htaccess files to be used to override much of the configuration, including authentication, handling of document types, auto generated indexes, access control, and options. Every AllowOverride directive must be None and AllowOverrideList must not be used. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

So wird geprüft

Prüfmethode: Shell-Befehl

shell
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk '{l=tolower($0)} l~/^allowoverride[[:space:]]/{n++; if(l!~/^allowoverride[[:space:]]+none[[:space:]]*$/) bad=1} l~/^allowoverridelist[[:space:]]/{bad=1} END{print bad?"noncompliant":"compliant"}'
Erwartete Ausgabe
compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Set AllowOverride None everywhere and remove AllowOverrideList directives. Then run apachectl configtest and reload Apache.

Eigenschaften

Betriebssysteme
Beliebig
Tags
apacheaccess-control
Referenz
CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 4.4 Ensure OverRide Is Disabled for All Directories

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell
tmaegis scan --target apache