TMA-APACHE-10.3
Ensure the LimitRequestFieldsize Directive is Set to 8190 or Less
RendahLevel 2Otomatisapache
Deskripsi
The LimitRequestFieldSize limits the number of bytes that will be allowed in an HTTP request header. It is recommended that the LimitRequestFieldSize directive be set to the default value of 8190 or less. LimitRequestFieldSize must be set and every value must be 8190 or less. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.
Cara pemeriksaan
Metode audit: Perintah shell
shell
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk 'tolower($1)=="limitrequestfieldsize"{n++; v=$2+0; if(!(v<=8190)) bad=1} END{print (n>0&&!bad)?"compliant":"noncompliant"}'- Output yang diharapkan
compliant
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Set LimitRequestFieldSize 8190 (or lower). Then run apachectl configtest and reload Apache.
Properti
- Sistem operasi
- Apa saja
- Tag
- apacherequest-limits
- Referensi
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 10.3 Ensure the LimitRequestFieldsize Directive is Set to 8190 or Less
Periksa host ini
Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.
shell
tmaegis scan --target apache --level 2