TMA-APACHE-3.11
Ensure Group Write Access for the Apache Directories and Files Is Properly Restricted
説明
Group permissions on Apache directories should generally be r-x and file permissions should be similar except not executable if executable is not appropriate. This applies to all of the Apache software directories and files installed with the possible exception of the web document root $DOCROOT defined by Apache DocumentRoot and defaults to $APACHE_PREFIX/htdocs. Counts files and directories under the ServerRoot writable by group; expects 0. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file. CIS marks this recommendation Manual; the automated check implements its audit procedure.
チェック方法
監査方法: シェルコマンド
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; [ -d "$R" ] || exit 1; find -L "$R" ! -type l -perm /g=w -print 2>/dev/null | wc -l- 期待される出力
0
修正方法
修正方法: ガイダンスまたは IaC パッチ
chmod -R g-w "$APACHE_PREFIX"
プロパティ
- オペレーティングシステム
- すべて
- タグ
- apacheaccounts
- 参照
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 3.11 Ensure Group Write Access for the Apache Directories and Files Is Properly Restricted
このホストをチェック
監査が許可されているマシンで実行してください。スキャンは読み取り専用です。
tmaegis scan --target apache