Ensure the Apache AppArmor Profile Is Configured Properly

낮음레벨 2수동 검토apache

설명

AppArmor includes customizable profiles that may be used to confine the Apache web server to enforce least privileges so that the server has only the minimal access to specified directories, files and network ports. Access is controlled by a profile defined for the apache2 process. The default AppArmor profile is typically a very permissive profile that allows read-write access to all system files. Manual review: the benchmark gives no reliable automated check for this control.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Perform the following steps to determine if the recommended state is implemented: 1. Find the Apache AppArmor profile typically found in /etc/apparmor.d/usr.sbin.apache2 along with any files included by the profile such as /etc/apparmor.d/apache2.d/* and files in the /etc/apparmor.d/abstractions/ directory. 2. Review the capabilities and permissions granted to ensure that the profile implements least privileges for the web application. Wild-card paths such as /**, which grant access to all files and directories starting with the root level directory, should not be present in the profile.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Perform the following to implement the recommended state: 1. Stop the Apache server # service apache2 stop 2. Create a mostly empty apache2 profile based on program dependencies. # aa-autodep apache2 Writing updated profile for /usr/sbin/apache2. 3. Set the apache2 profile in complain mode so that access violations will be allowed and logged. # aa-complain apache2 Setting /usr/sbin/apache2 to complain mode. 4. Start the apache2 service # service apache2 start 5. Thoroughly test the web application attempting to exercise all intended functionality so that AppArmor will generate the necessary logs of all resources accessed. The logs are sent via the system syslog utility and are typically found in either the /var/log/syslog or /var/log/messages files. Also stop and restart the web server as part of the testing process. 6.

속성

운영 체제: 모두
태그: apacheapparmor
참고 자료: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 12.2 Ensure the Apache AppArmor Profile Is Configured Properly