TMAegis
apache のその他のルール

TMA-APACHE-3.4

Ensure Apache Directories and Files Are Owned By Root

高レベル 1自動apache

説明

The Apache directories and files should be owned by root. This applies to all of the Apache software directories and files installed. Counts files under the ServerRoot (APACHE_PREFIX) not owned by root; expects 0. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

チェック方法

監査方法: シェルコマンド

shell
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; [ -d "$R" ] || exit 1; find "$R" ! -user root -print 2>/dev/null | wc -l
期待される出力
0

修正方法

修正方法: ガイダンスまたは IaC パッチ

chown -R root "$APACHE_PREFIX" (the ServerRoot, e.g. /etc/httpd or /etc/apache2).

プロパティ

オペレーティングシステム
すべて
タグ
apacheaccounts
参照
CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 3.4 Ensure Apache Directories and Files Are Owned By Root

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell
tmaegis scan --target apache