TMAegis
More rules for apache

TMA-APACHE-3.4

Ensure Apache Directories and Files Are Owned By Root

HighLevel 1Automatedapache

Description

The Apache directories and files should be owned by root. This applies to all of the Apache software directories and files installed. Counts files under the ServerRoot (APACHE_PREFIX) not owned by root; expects 0. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

How it is checked

Audit method: Shell command

shell
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; [ -d "$R" ] || exit 1; find "$R" ! -user root -print 2>/dev/null | wc -l
Expected output
0

How it is fixed

Fix method: Guidance or infrastructure patch

chown -R root "$APACHE_PREFIX" (the ServerRoot, e.g. /etc/httpd or /etc/apache2).

Properties

Operating systems
Any
Tags
apacheaccounts
Reference
CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 3.4 Ensure Apache Directories and Files Are Owned By Root

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell
tmaegis scan --target apache