Ensure Access to OS Root Directory Is Denied By Default

TinggiLevel 1Otomatisapache

Deskripsi

The Apache Directory directive allows for directory specific configuration of access controls and many other features and options. One important usage is to create a default deny policy that does not allow access to operating system directories and files, except for those specifically allowed. This is done by denying access to the OS root directory. The <Directory /> block must contain a single "Require all denied" and no Allow/Deny (or the legacy Order deny,allow + Deny from all with no Allow/Require). Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

Cara pemeriksaan

Metode audit: Perintah shell

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk '{l=tolower($0); $0=l} /^<directory[[:space:]]/{dd++; if(dd==1){x=$2; gsub(/[">]/,"",x); r=(x=="/"); if(r) f=1}; next} /^<\/directory>/{dd--; if(dd==0) r=0; next} r && $1=="require"{nr++; if($0~/^require[[:space:]]+all[[:space:]]+denied/) rd++} r && $1=="allow"{al++} r && $1=="deny"{dn++; if($0~/from[[:space:]]+all/) dfa=1} r && $1=="order"{no++; if($0~/deny,[[:space:]]*allow/) oda=1} END{print (f && ((nr==1&&rd==1&&al==0&&dn==0) || (no==1&&oda&&dfa&&al==0&&nr==0)))?"compliant":"noncompliant"}'

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

In the main configuration: <Directory /> ... Require all denied ... </Directory> (remove Allow/Deny/other Require lines). Then run apachectl configtest and reload Apache.

Properti

Sistem operasi: Apa saja
Tag: apacheaccess-control
Referensi: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 4.1 Ensure Access to OS Root Directory Is Denied By Default

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target apache