TMA-APACHE-7.7
Ensure SSL Compression is not Enabled
보통레벨 1자동apache
설명
The SSLCompression directive controls whether SSL compression is used by Apache when serving content over HTTPS. It is recommended that the SSLCompression directive be set to off. SSLCompression must be absent or off (CRIME). Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file. CIS marks this recommendation Manual; the automated check implements its audit procedure.
점검 방법
감사 방식: 셸 명령
shell
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk 'tolower($1)=="sslcompression" && tolower($2)!="off"{bad=1} END{print bad?"noncompliant":"compliant"}'- 예상 출력
compliant
조치 방법
조치 방식: 가이드 또는 인프라 패치
Remove SSLCompression on (or set SSLCompression off). Then run apachectl configtest and reload Apache.
속성
- 운영 체제
- 모두
- 태그
- apachetls
- 참고 자료
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 7.7 Ensure SSL Compression is not Enabled
이 호스트 점검하기
감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.
shell
tmaegis scan --target apache