Ensure Only Necessary Authentication and Authorization Modules Are Enabled

보통레벨 1수동 검토apache

설명

The Apache 2.4 modules for authentication and authorization are grouped and named to provide both granularity and a consistent naming convention to simplify configuration. The authn_* modules provide authentication, while the authz_* modules provide authorization. Apache provides two types of authentication - basic and digest. Manual review: the benchmark gives no reliable automated check for this control.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

1. Use the httpd -M option as root to check which auth*modules are loaded. # httpd -M | egrep 'auth._' 2. Also use the httpd -M option as root to check for any LDAP modules which don't follow the same naming convention. # httpd -M | egrep 'ldap' The above commands should generate a Syntax OK message to stderr, in addition to a list of modules installed to stdout. If the Syntax OK message is missing, then there was most likely an error in parsing the configuration files.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Consult Apache module documentation for descriptions of each module in order to determine the necessary modules for the specific installation. https://httpd.apache.org/docs/2.4/mod/ The unnecessary static compiled modules are disabled through compile time configuration options as documented in https://httpd.apache.org/docs/2.4/programs/configure.html. The dynamically loaded modules are disabled by commenting out or removing the LoadModule directive from the Apache configuration files (typically httpd.conf). Some modules may be separate packages, and may be removed.

속성

운영 체제: 모두
태그: apachemodules
참고 자료: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 2.1 Ensure Only Necessary Authentication and Authorization Modules Are Enabled