Apache HTTP Server
TMA-APACHE-9.5
Ensure the Timeout Limits for Request Headers is Set to 40 or Less
Description
The RequestReadTimeout directive allows configuration of timeout limits for client requests. The header portion of the directive provides for an initial timeout value, a maximum timeout and a minimum rate. The minimum rate specifies that after the initial timeout, the server will wait an additional 1 second for each N bytes received. The recommended setting is to have a maximum timeout of 40 seconds or less. Every RequestReadTimeout must limit the header timeout to 40 seconds or less (upper bound of a range); without RequestReadTimeout the mod_reqtimeout default (header=20-40) is compliant when the module is loaded. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file. Uses the module list from apachectl -M (apache2ctl/httpd; needs root). CIS marks this recommendation Manual; the automated check implements its audit procedure.
How it is checked
Audit method: Shell command
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; b=$(command -v apache2ctl || command -v apachectl || command -v httpd) || exit 1; m=$("$b" ${APACHE_CONF:+-f "$APACHE_CONF"} -M 2>/dev/null) || exit 1; printf '%s\n' "$m" | grep -q reqtimeout_module && r=1 || r=0; printf '%s\n' "$cfg" | awk -v r="$r" 'tolower($1)=="requestreadtimeout"{n++; for(i=2;i<=NF;i++){t=tolower($i); if(t~/^header=/){x=t; sub(/^[a-z]+=/,"",x); sub(/,.*/,"",x); k=split(x,y,"-"); if(y[k]+0>40 || y[k]+0==0) bad=1}}} END{print ((n>0 && !bad) || (n==0 && r))?"compliant":"noncompliant"}'- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Load mod_reqtimeout and set e.g. RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500. Then run apachectl configtest and reload Apache.
Properties
- Operating systems
- Any
- Tags
- apachedos
- Reference
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 9.5 Ensure the Timeout Limits for Request Headers is Set to 40 or Less
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target apache