Ensure OverRide Is Disabled for the OS Root Directory

MediumLevel 1Automatedapache

Description

The Apache AllowOverRide directive and the new AllowOverrideList directive allow for .htaccess files to be used to override much of the configuration, including authentication, handling of document types, auto generated indexes, access control, and options. The <Directory /> block must contain a single AllowOverride None and no AllowOverrideList. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

How it is checked

Audit method: Shell command

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk '{l=tolower($0); $0=l} /^<directory[[:space:]]/{dd++; if(dd==1){x=$2; gsub(/[">]/,"",x); r=(x=="/"); if(r) f=1}; next} /^<\/directory>/{dd--; if(dd==0) r=0; next} r && $1=="allowoverride"{n++; if($2=="none") ok++} r && $1=="allowoverridelist"{bad=1} END{print (f&&n==1&&ok==1&&!bad)?"compliant":"noncompliant"}'

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Set AllowOverride None in the <Directory /> block and remove AllowOverrideList. Then run apachectl configtest and reload Apache.

Properties

Operating systems: Any
Tags: apacheaccess-control
Reference: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 4.3 Ensure OverRide Is Disabled for the OS Root Directory

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target apache