Ensure OCSP Stapling Is Enabled

BajaNivel 2Automatizadaapache

Descripción

The OCSP (Online Certificate Status Protocol) provides the current revocation status of an X.509 certificate and allows for a certificate authority to revoke the validity of a signed certificate before its expiration date. The URI for the OCSP server is included in the certificate and verified by the browser. SSLUseStapling on must be set (no occurrence off) and an SSLStaplingCache must be configured. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file. CIS marks this recommendation Manual; the automated check implements its audit procedure.

Cómo se verifica

Método de auditoría: Comando de shell

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk 'tolower($1)=="sslusestapling"{n++; if(tolower($2)!="on") bad=1} tolower($1)=="sslstaplingcache"{c=1} END{print (n>0&&c&&!bad)?"compliant":"noncompliant"}'

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

At server level: SSLStaplingCache "shmcb:logs/ssl_staple_cache(512000)" and SSLUseStapling On (also in each TLS virtual host). Then run apachectl configtest and reload Apache.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: apachetls
Referencia: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 7.10 Ensure OCSP Stapling Is Enabled

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target apache --level 2