TMA-APACHE-11.4

Ensure Only the Necessary SELinux Booleans are Enabled

낮음레벨 2수동 검토apache

설명

SELinux booleans allow or disallow behavior specific to the Apache web server. Common examples include whether CGI execution is allowed, or if the httpd server is allowed to communicate with the current terminal (tty). Communication with the terminal, may be necessary for entering a passphrase during start up to decrypt a private key. Manual review: the benchmark gives no reliable automated check for this control.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Perform the following steps to determine if the recommended state is implemented: Review the SELinux httpd booleans that are enabled to ensure only the necessary booleans are enabled for the current and the configured state. Due to the variety and complexity of web server usages and organizational needs, a preset recommendation of enabled booleans is not practical. Run either of the two commands below to show only the enabled httpd related booleans.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Perform the following to implement the recommended state: To disable the SELinux httpd booleans that are determined to be unnecessary, use the setsebool command as shown below with the -P option to make the change persistent. # setsebool -P httpd_enable_cgi off # getsebool httpd_enable_cgi httpd_enable_cgi --> off

속성

운영 체제: 모두
태그: apacheselinux
참고 자료: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 11.4 Ensure Only the Necessary SELinux Booleans are Enabled