Ensure Access to OS Root Directory Is Denied By Default

HighLevel 1Automatedapache

Description

The Apache Directory directive allows for directory specific configuration of access controls and many other features and options. One important usage is to create a default deny policy that does not allow access to operating system directories and files, except for those specifically allowed. This is done by denying access to the OS root directory. The <Directory /> block must contain a single "Require all denied" and no Allow/Deny (or the legacy Order deny,allow + Deny from all with no Allow/Require). Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

How it is checked

Audit method: Shell command

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk '{l=tolower($0); $0=l} /^<directory[[:space:]]/{dd++; if(dd==1){x=$2; gsub(/[">]/,"",x); r=(x=="/"); if(r) f=1}; next} /^<\/directory>/{dd--; if(dd==0) r=0; next} r && $1=="require"{nr++; if($0~/^require[[:space:]]+all[[:space:]]+denied/) rd++} r && $1=="allow"{al++} r && $1=="deny"{dn++; if($0~/from[[:space:]]+all/) dfa=1} r && $1=="order"{no++; if($0~/deny,[[:space:]]*allow/) oda=1} END{print (f && ((nr==1&&rd==1&&al==0&&dn==0) || (no==1&&oda&&dfa&&al==0&&nr==0)))?"compliant":"noncompliant"}'

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

In the main configuration: <Directory /> ... Require all denied ... </Directory> (remove Allow/Deny/other Require lines). Then run apachectl configtest and reload Apache.

Properties

Operating systems: Any
Tags: apacheaccess-control
Reference: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 4.1 Ensure Access to OS Root Directory Is Denied By Default

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target apache