Ensure ETag Response Header Fields Do Not Include Inodes

BaixaNível 2Automatizadaapache

Descrição

The FileETag directive configures the file attributes that are used to create the ETag (entity tag) response header field when the document is based on a static file. The ETag value is used in cache management to save network bandwidth. The value returned may be based on combinations of the file inode, the modification time, and the file size. No FileETag directive may include All, INode or +INode (absent is compliant; the default is MTime Size). Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

Como é verificado

Método de auditoria: Comando shell

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk 'tolower($1)=="fileetag"{for(i=2;i<=NF;i++){t=tolower($i); if(t=="all"||t=="inode"||t=="+inode") bad=1}} END{print bad?"noncompliant":"compliant"}'

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Remove FileETag or set FileETag None (or MTime Size). Then run apachectl configtest and reload Apache.

Propriedades

Sistemas operacionais: Qualquer
Tags: apacheinformation-disclosure
Referência: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 8.4 Ensure ETag Response Header Fields Do Not Include Inodes

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target apache --level 2