Ensure the Timeout Limits for Request Headers is Set to 40 or Less

中レベル 1自動apache

説明

The RequestReadTimeout directive allows configuration of timeout limits for client requests. The header portion of the directive provides for an initial timeout value, a maximum timeout and a minimum rate. The minimum rate specifies that after the initial timeout, the server will wait an additional 1 second for each N bytes received. The recommended setting is to have a maximum timeout of 40 seconds or less. Every RequestReadTimeout must limit the header timeout to 40 seconds or less (upper bound of a range); without RequestReadTimeout the mod_reqtimeout default (header=20-40) is compliant when the module is loaded. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file. Uses the module list from apachectl -M (apache2ctl/httpd; needs root). CIS marks this recommendation Manual; the automated check implements its audit procedure.

チェック方法

監査方法: シェルコマンド

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; b=$(command -v apache2ctl || command -v apachectl || command -v httpd) || exit 1; m=$("$b" ${APACHE_CONF:+-f "$APACHE_CONF"} -M 2>/dev/null) || exit 1; printf '%s\n' "$m" | grep -q reqtimeout_module && r=1 || r=0; printf '%s\n' "$cfg" | awk -v r="$r" 'tolower($1)=="requestreadtimeout"{n++; for(i=2;i<=NF;i++){t=tolower($i); if(t~/^header=/){x=t; sub(/^[a-z]+=/,"",x); sub(/,.*/,"",x); k=split(x,y,"-"); if(y[k]+0>40 || y[k]+0==0) bad=1}}} END{print ((n>0 && !bad) || (n==0 && r))?"compliant":"noncompliant"}'

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Load mod_reqtimeout and set e.g. RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500. Then run apachectl configtest and reload Apache.

プロパティ

オペレーティングシステム: すべて
タグ: apachedos
参照: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 9.5 Ensure the Timeout Limits for Request Headers is Set to 40 or Less

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target apache