Ensure Options for Other Directories Are Minimized

낮음레벨 2자동apache

설명

The Apache Options directive allows for specific configuration of options, including execution of CGI, following symbolic links, server side includes, and content negotiation. No Options directive inside a <Directory> block may enable Includes, IncludesNOEXEC or All. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

점검 방법

감사 방식: 셸 명령

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk '/^<[Dd]irectory/{dd=1; next} /^<\/[Dd]irectory>/{dd=0; next} dd && tolower($1)=="options"{for(i=2;i<=NF;i++){t=tolower($i); if(t~/^\+?includes(noexec)?$/ || t~/^\+?all$/) bad=1}} END{print bad?"noncompliant":"compliant"}'

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Remove Includes (and All) from Options in every <Directory> block; use only the options each directory needs. Then run apachectl configtest and reload Apache.

속성

운영 체제: 모두
태그: apachefeatures
참고 자료: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 5.3 Ensure Options for Other Directories Are Minimized

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target apache --level 2