TMA-APACHE-3.5
Ensure the Group Is Set Correctly on Apache Directories and Files
설명
The Apache directories and files should be set to have a group Id of root, (or a root equivalent) group. This applies to all of the Apache software directories and files installed. The only expected exception is that the Apache web document root ($APACHE_PREFIX/htdocs) is likely to need a designated group to allow web content to be updated (such as webupdate) through a change management process. Counts files under the ServerRoot (except htdocs) whose group is not root; expects 0. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.
점검 방법
감사 방식: 셸 명령
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; [ -d "$R" ] || exit 1; find "$R" -path "$R/htdocs" -prune -o ! -group root -print 2>/dev/null | wc -l- 예상 출력
0
조치 방법
조치 방식: 가이드 또는 인프라 패치
chgrp -R root "$APACHE_PREFIX" (excluding htdocs).
속성
- 운영 체제
- 모두
- 태그
- apacheaccounts
- 참고 자료
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 3.5 Ensure the Group Is Set Correctly on Apache Directories and Files
이 호스트 점검하기
감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.
tmaegis scan --target apache