Apache HTTP Server
TMA-APACHE-9.6
Ensure Timeout Limits for the Request Body is Set to 20 or Less
Descripción
The RequestReadTimeout directive also allows setting timeout values for the body portion of a request. The directive provides for an initial timeout value, and a maximum timeout and minimum rate. The minimum rate specifies that after the initial timeout, the server will wait an additional 1 second for each N bytes received. The recommended setting is to have a maximum timeout of 20 seconds or less. Every RequestReadTimeout must limit the body timeout to 20 seconds or less (upper bound of a range); without RequestReadTimeout the mod_reqtimeout default (body=20) is compliant when the module is loaded. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file. Uses the module list from apachectl -M (apache2ctl/httpd; needs root). CIS marks this recommendation Manual; the automated check implements its audit procedure.
Cómo se verifica
Método de auditoría: Comando de shell
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; b=$(command -v apache2ctl || command -v apachectl || command -v httpd) || exit 1; m=$("$b" ${APACHE_CONF:+-f "$APACHE_CONF"} -M 2>/dev/null) || exit 1; printf '%s\n' "$m" | grep -q reqtimeout_module && r=1 || r=0; printf '%s\n' "$cfg" | awk -v r="$r" 'tolower($1)=="requestreadtimeout"{n++; for(i=2;i<=NF;i++){t=tolower($i); if(t~/^body=/){x=t; sub(/^[a-z]+=/,"",x); sub(/,.*/,"",x); k=split(x,y,"-"); if(y[k]+0>20 || y[k]+0==0) bad=1}}} END{print ((n>0 && !bad) || (n==0 && r))?"compliant":"noncompliant"}'- Salida esperada
compliant
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Load mod_reqtimeout and set e.g. RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500. Then run apachectl configtest and reload Apache.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- apachedos
- Referencia
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 9.6 Ensure Timeout Limits for the Request Body is Set to 20 or Less
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
tmaegis scan --target apache