TMA-APACHE-9.6
Ensure Timeout Limits for the Request Body is Set to 20 or Less
Beschreibung
The RequestReadTimeout directive also allows setting timeout values for the body portion of a request. The directive provides for an initial timeout value, and a maximum timeout and minimum rate. The minimum rate specifies that after the initial timeout, the server will wait an additional 1 second for each N bytes received. The recommended setting is to have a maximum timeout of 20 seconds or less. Every RequestReadTimeout must limit the body timeout to 20 seconds or less (upper bound of a range); without RequestReadTimeout the mod_reqtimeout default (body=20) is compliant when the module is loaded. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file. Uses the module list from apachectl -M (apache2ctl/httpd; needs root). CIS marks this recommendation Manual; the automated check implements its audit procedure.
So wird geprüft
Prüfmethode: Shell-Befehl
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; b=$(command -v apache2ctl || command -v apachectl || command -v httpd) || exit 1; m=$("$b" ${APACHE_CONF:+-f "$APACHE_CONF"} -M 2>/dev/null) || exit 1; printf '%s\n' "$m" | grep -q reqtimeout_module && r=1 || r=0; printf '%s\n' "$cfg" | awk -v r="$r" 'tolower($1)=="requestreadtimeout"{n++; for(i=2;i<=NF;i++){t=tolower($i); if(t~/^body=/){x=t; sub(/^[a-z]+=/,"",x); sub(/,.*/,"",x); k=split(x,y,"-"); if(y[k]+0>20 || y[k]+0==0) bad=1}}} END{print ((n>0 && !bad) || (n==0 && r))?"compliant":"noncompliant"}'- Erwartete Ausgabe
compliant
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
Load mod_reqtimeout and set e.g. RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500. Then run apachectl configtest and reload Apache.
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- apachedos
- Referenz
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 9.6 Ensure Timeout Limits for the Request Body is Set to 20 or Less
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
tmaegis scan --target apache