Apache HTTP Server
TMA-APACHE-5.10
Ensure Access to .ht* Files Is Restricted
Deskripsi
Restrict access to any files beginning with .ht using the FilesMatch directive. The default name for access filename which allows files in web directories to override the Apache configuration is .htaccess. The usage of access files should not be allowed, but as a defense in depth a FilesMatch directive is recommended to prevent web clients from viewing those files in case they are created. A <FilesMatch "^\.ht"> block containing Require all denied (or Deny from all) must exist. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.
Cara pemeriksaan
Metode audit: Perintah shell
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk '{l=tolower($0)} l~/^<filesmatch[[:space:]]/ && index(l,"^\\.ht"){b=1; next} b && l~/^<\/filesmatch>/{b=0; next} b && (l~/^require[[:space:]]+all[[:space:]]+denied/ || l~/^deny[[:space:]]+from[[:space:]]+all/){ok=1} END{print ok?"compliant":"noncompliant"}'- Output yang diharapkan
compliant
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Add at server level: <FilesMatch "^\.ht"> Require all denied </FilesMatch> Then run apachectl configtest and reload Apache.
Properti
- Sistem operasi
- Apa saja
- Tag
- apachefeatures
- Referensi
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 5.10 Ensure Access to .ht* Files Is Restricted
Periksa host ini
Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.
tmaegis scan --target apache