Ensure OCSP Stapling Is Enabled

낮음레벨 2자동apache

설명

The OCSP (Online Certificate Status Protocol) provides the current revocation status of an X.509 certificate and allows for a certificate authority to revoke the validity of a signed certificate before its expiration date. The URI for the OCSP server is included in the certificate and verified by the browser. SSLUseStapling on must be set (no occurrence off) and an SSLStaplingCache must be configured. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file. CIS marks this recommendation Manual; the automated check implements its audit procedure.

점검 방법

감사 방식: 셸 명령

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk 'tolower($1)=="sslusestapling"{n++; if(tolower($2)!="on") bad=1} tolower($1)=="sslstaplingcache"{c=1} END{print (n>0&&c&&!bad)?"compliant":"noncompliant"}'

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

At server level: SSLStaplingCache "shmcb:logs/ssl_staple_cache(512000)" and SSLUseStapling On (also in each TLS virtual host). Then run apachectl configtest and reload Apache.

속성

운영 체제: 모두
태그: apachetls
참고 자료: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 7.10 Ensure OCSP Stapling Is Enabled

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target apache --level 2