Apache HTTP Server
TMA-APACHE-3.6
Ensure Other Write Access on Apache Directories and Files Is Restricted
Description
Permissions on Apache directories should generally be rwxr-xr-x (755) and file permissions should be similar except not executable unless appropriate. This applies to all of the Apache software directories and files installed with the possible exception of the web document root $APACHE_PREFIX/htdocs. Counts files and directories under the ServerRoot writable by others; expects 0. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file. CIS marks this recommendation Manual; the automated check implements its audit procedure.
How it is checked
Audit method: Shell command
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; [ -d "$R" ] || exit 1; find -L "$R" ! -type l -perm /o=w -print 2>/dev/null | wc -l- Expected output
0
How it is fixed
Fix method: Guidance or infrastructure patch
chmod -R o-w "$APACHE_PREFIX"
Properties
- Operating systems
- Any
- Tags
- apacheaccounts
- Reference
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 3.6 Ensure Other Write Access on Apache Directories and Files Is Restricted
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target apache