TMA-APACHE-3.4
Ensure Apache Directories and Files Are Owned By Root
高レベル 1自動apache
説明
The Apache directories and files should be owned by root. This applies to all of the Apache software directories and files installed. Counts files under the ServerRoot (APACHE_PREFIX) not owned by root; expects 0. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.
チェック方法
監査方法: シェルコマンド
shell
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; [ -d "$R" ] || exit 1; find "$R" ! -user root -print 2>/dev/null | wc -l- 期待される出力
0
修正方法
修正方法: ガイダンスまたは IaC パッチ
chown -R root "$APACHE_PREFIX" (the ServerRoot, e.g. /etc/httpd or /etc/apache2).
プロパティ
- オペレーティングシステム
- すべて
- タグ
- apacheaccounts
- 参照
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 3.4 Ensure Apache Directories and Files Are Owned By Root
このホストをチェック
監査が許可されているマシンで実行してください。スキャンは読み取り専用です。
shell
tmaegis scan --target apache