Ensure OverRide Is Disabled for the OS Root Directory

MoyenneNiveau 1Automatiséeapache

Description

The Apache AllowOverRide directive and the new AllowOverrideList directive allow for .htaccess files to be used to override much of the configuration, including authentication, handling of document types, auto generated indexes, access control, and options. The <Directory /> block must contain a single AllowOverride None and no AllowOverrideList. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

Méthode de vérification

Méthode d'audit: Commande shell

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk '{l=tolower($0); $0=l} /^<directory[[:space:]]/{dd++; if(dd==1){x=$2; gsub(/[">]/,"",x); r=(x=="/"); if(r) f=1}; next} /^<\/directory>/{dd--; if(dd==0) r=0; next} r && $1=="allowoverride"{n++; if($2=="none") ok++} r && $1=="allowoverridelist"{bad=1} END{print (f&&n==1&&ok==1&&!bad)?"compliant":"noncompliant"}'

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Set AllowOverride None in the <Directory /> block and remove AllowOverrideList. Then run apachectl configtest and reload Apache.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: apacheaccess-control
Référence: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 4.3 Ensure OverRide Is Disabled for the OS Root Directory

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target apache