TMA-APACHE-4.4
Ensure OverRide Is Disabled for All Directories
中レベル 1自動apache
説明
The Apache AllowOverride directive and the new AllowOverrideList directive allow for .htaccess files to be used to override much of the configuration, including authentication, handling of document types, auto generated indexes, access control, and options. Every AllowOverride directive must be None and AllowOverrideList must not be used. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.
チェック方法
監査方法: シェルコマンド
shell
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk '{l=tolower($0)} l~/^allowoverride[[:space:]]/{n++; if(l!~/^allowoverride[[:space:]]+none[[:space:]]*$/) bad=1} l~/^allowoverridelist[[:space:]]/{bad=1} END{print bad?"noncompliant":"compliant"}'- 期待される出力
compliant
修正方法
修正方法: ガイダンスまたは IaC パッチ
Set AllowOverride None everywhere and remove AllowOverrideList directives. Then run apachectl configtest and reload Apache.
プロパティ
- オペレーティングシステム
- すべて
- タグ
- apacheaccess-control
- 参照
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 4.4 Ensure OverRide Is Disabled for All Directories
このホストをチェック
監査が許可されているマシンで実行してください。スキャンは読み取り専用です。
shell
tmaegis scan --target apache