Ensure Access to .ht* Files Is Restricted

MédiaNível 1Automatizadaapache

Descrição

Restrict access to any files beginning with .ht using the FilesMatch directive. The default name for access filename which allows files in web directories to override the Apache configuration is .htaccess. The usage of access files should not be allowed, but as a defense in depth a FilesMatch directive is recommended to prevent web clients from viewing those files in case they are created. A <FilesMatch "^\.ht"> block containing Require all denied (or Deny from all) must exist. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

Como é verificado

Método de auditoria: Comando shell

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk '{l=tolower($0)} l~/^<filesmatch[[:space:]]/ && index(l,"^\\.ht"){b=1; next} b && l~/^<\/filesmatch>/{b=0; next} b && (l~/^require[[:space:]]+all[[:space:]]+denied/ || l~/^deny[[:space:]]+from[[:space:]]+all/){ok=1} END{print ok?"compliant":"noncompliant"}'

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Add at server level: <FilesMatch "^\.ht"> Require all denied </FilesMatch> Then run apachectl configtest and reload Apache.

Propriedades

Sistemas operacionais: Qualquer
Tags: apachefeatures
Referência: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 5.10 Ensure Access to .ht* Files Is Restricted

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target apache