Apache HTTP Server
TMA-APACHE-5.10
Ensure Access to .ht* Files Is Restricted
Description
Restrict access to any files beginning with .ht using the FilesMatch directive. The default name for access filename which allows files in web directories to override the Apache configuration is .htaccess. The usage of access files should not be allowed, but as a defense in depth a FilesMatch directive is recommended to prevent web clients from viewing those files in case they are created. A <FilesMatch "^\.ht"> block containing Require all denied (or Deny from all) must exist. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.
Méthode de vérification
Méthode d'audit: Commande shell
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk '{l=tolower($0)} l~/^<filesmatch[[:space:]]/ && index(l,"^\\.ht"){b=1; next} b && l~/^<\/filesmatch>/{b=0; next} b && (l~/^require[[:space:]]+all[[:space:]]+denied/ || l~/^deny[[:space:]]+from[[:space:]]+all/){ok=1} END{print ok?"compliant":"noncompliant"}'- Sortie attendue
compliant
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
Add at server level: <FilesMatch "^\.ht"> Require all denied </FilesMatch> Then run apachectl configtest and reload Apache.
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- apachefeatures
- Référence
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 5.10 Ensure Access to .ht* Files Is Restricted
Vérifier cet hôte
Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.
tmaegis scan --target apache