TMA-APACHE-3.8
Ensure the Lock File Is Secured
설명
The Mutex directive sets the locking mechanism used to serialize access to resources. It may be used to specify that a lock file is to be used as a mutex mechanism and may provide the path to the lock file to be used with the fcntl(2) or flock(2) system calls. Most Linux systems will default to using semaphores instead, so the directive may not apply. Manual review: the benchmark gives no reliable automated check for this control.
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
Verify the configuration does NOT include a Mutex directive with the mechanism of fcntl, flock or file. If one of the file locking mechanisms is configured, then find the directory in which the lock file would be created. The default value is the ServerRoot/logs directory. 1. Verify that the lock file directory is not a directory within the Apache DocumentRoot 2. Verify that the ownership and group of the directory is root:root (or the user under which Apache initially starts up if not root). 3.
조치 방법
조치 방식: 가이드 또는 인프라 패치
Find the directory path in which the lock file would be created. The default value is the ServerRoot/logs directory. 1. Modify the directory if the path is a directory within the Apache DocumentRoot 2. Change the ownership and group to be root:root, if not already. 3. Change the permissions so that the directory is only writable by root, or the user under which Apache initially starts up (default is root), 4. Check that the lock file directory is on a locally mounted hard drive rather than an NFS mounted file system.
속성
- 운영 체제
- 모두
- 태그
- apacheaccounts
- 참고 자료
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 3.8 Ensure the Lock File Is Secured