Ensure the IP Addresses for Listening for Requests Are Specified

BajaNivel 2Automatizadaapache

Descripción

The Apache Listen directive specifies the IP addresses and port numbers the Apache web server will listen for requests. Rather than be unrestricted to listen on all IP addresses available to the system, the specific IP address or addresses intended should be explicitly specified. Specifically, a Listen directive with no IP address specified, or with an IP address of zeros should not be used. Every Listen directive must name a specific IP address (not just a port, *, 0.0.0.0 or [::]). Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

Cómo se verifica

Método de auditoría: Comando de shell

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk 'tolower($1)=="listen"{n++; v=$2; if(v~/^[0-9]+$/ || v~/^\*:/ || v~/^0\.0\.0\.0:/ || v~/^\[::\]:/) bad=1} END{print (n>0&&!bad)?"compliant":"noncompliant"}'

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Change each Listen to an explicit address, e.g. Listen 10.20.30.40:80. Then run apachectl configtest and reload Apache.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: apachenetwork
Referencia: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 5.15 Ensure the IP Addresses for Listening for Requests Are Specified

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target apache --level 2