TMAegis
apache のその他のルール

Apache HTTP Server

TMA-APACHE-5.15

Ensure the IP Addresses for Listening for Requests Are Specified

低レベル 2自動apache

説明

The Apache Listen directive specifies the IP addresses and port numbers the Apache web server will listen for requests. Rather than be unrestricted to listen on all IP addresses available to the system, the specific IP address or addresses intended should be explicitly specified. Specifically, a Listen directive with no IP address specified, or with an IP address of zeros should not be used. Every Listen directive must name a specific IP address (not just a port, *, 0.0.0.0 or [::]). Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

チェック方法

監査方法: シェルコマンド

shell
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk 'tolower($1)=="listen"{n++; v=$2; if(v~/^[0-9]+$/ || v~/^\*:/ || v~/^0\.0\.0\.0:/ || v~/^\[::\]:/) bad=1} END{print (n>0&&!bad)?"compliant":"noncompliant"}'
期待される出力
compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Change each Listen to an explicit address, e.g. Listen 10.20.30.40:80. Then run apachectl configtest and reload Apache.

プロパティ

オペレーティングシステム
すべて
タグ
apachenetwork
参照
CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 5.15 Ensure the IP Addresses for Listening for Requests Are Specified

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell
tmaegis scan --target apache --level 2