TMA-APACHE-8.4

Ensure ETag Response Header Fields Do Not Include Inodes

BajaNivel 2Automatizadaapache

Descripción

The FileETag directive configures the file attributes that are used to create the ETag (entity tag) response header field when the document is based on a static file. The ETag value is used in cache management to save network bandwidth. The value returned may be based on combinations of the file inode, the modification time, and the file size. No FileETag directive may include All, INode or +INode (absent is compliant; the default is MTime Size). Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

Cómo se verifica

Método de auditoría: Comando de shell

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk 'tolower($1)=="fileetag"{for(i=2;i<=NF;i++){t=tolower($i); if(t=="all"||t=="inode"||t=="+inode") bad=1}} END{print bad?"noncompliant":"compliant"}'

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Remove FileETag or set FileETag None (or MTime Size). Then run apachectl configtest and reload Apache.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: apacheinformation-disclosure
Referencia: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 8.4 Ensure ETag Response Header Fields Do Not Include Inodes

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target apache --level 2