TMA-APACHE-7.4

Ensure the TLSv1.0 and TLSv1.1 Protocols are Disabled

높음레벨 1자동apache

설명

The TLSv1.0 and TLSv1.1 protocols should be disabled via the SSLProtocol directive. The TLSv1.0 protocol is vulnerable to information disclosure and both protocols lack support for modern cryptographic algorithms including authenticated encryption. The only SSL/TLS protocols that should be allowed is TLSv1.2 along with the newer TLSv1.3 protocol. The effective SSLProtocol (last one at server level and in each virtual host) must resolve to TLSv1.2 and/or TLSv1.3 only (e.g. SSLProtocol +TLSv1.2 +TLSv1.3, or all -SSLv3 -TLSv1 -TLSv1.1), and at least one must exist. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file. CIS marks this recommendation Manual; the automated check implements its audit procedure.

점검 방법

감사 방식: 셸 명령

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; eff(){ printf '%s\n' "$cfg" | awk -v k="$1" '{l=tolower($0)} l~/^<virtualhost/{vh=1; next} l~/^<\/virtualhost>/{if(v!="") print v; v=""; vh=0; next} tolower($1)==tolower(k){if(vh) v=$0; else g=$0} END{if(g!="") print g}'; }; eff SSLProtocol | awk 'tolower($1)=="sslprotocol"{n++; delete s; for(i=2;i<=NF;i++){t=$i; p=substr(t,1,1); if(p=="+"||p=="-") t=substr(t,2); else delete s; t=tolower(t); if(t=="all"){split("sslv3 tlsv1 tlsv1.1 tlsv1.2 tlsv1.3",z," "); for(j in z) if(p=="-") delete s[z[j]]; else s[z[j]]=1} else if(p=="-") delete s[t]; else s[t]=1} k=0; for(x in s){k++; if(x!="tlsv1.2" && x!="tlsv1.3") bad=1} if(k==0) bad=1} END{print (n>0&&!bad)?"compliant":"noncompliant"}'

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Set SSLProtocol +TLSv1.2 +TLSv1.3 (or +TLSv1.2) at server level and in every TLS virtual host. Then run apachectl configtest and reload Apache.

속성

운영 체제: 모두
태그: apachetls
참고 자료: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 7.4 Ensure the TLSv1.0 and TLSv1.1 Protocols are Disabled

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target apache