Ensure HTTP Strict Transport Security Is Enabled

НизкийУровень 2Автоматическаяapache

Описание

HTTP Strict Transport Security (HSTS) is an optional web server security policy mechanism specified by an HTTP Server header. The HSTS header allows a server declaration that only HTTPS communication should be used rather than clear text HTTP communication. At least one Header directive must set Strict-Transport-Security and every such header must have max-age of 480 seconds or more. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file. CIS marks this recommendation Manual; the automated check implements its audit procedure.

Как проверяется

Метод проверки: Команда оболочки

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk '{l=tolower($0)} l~/^header[[:space:]]/ && l~/strict-transport-security/{n++; m=0; if(match(l,/max-age=[0-9]+/)) m=substr(l,RSTART+8,RLENGTH-8)+0; if(m<480) bad=1} END{print (n>0&&!bad)?"compliant":"noncompliant"}'

Ожидаемый вывод: compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Header always set Strict-Transport-Security "max-age=600" (at server level and in each TLS virtual host). Then run apachectl configtest and reload Apache.

Свойства

Операционные системы: Любая
Теги: apachetlsheaders
Источник: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 7.11 Ensure HTTP Strict Transport Security Is Enabled

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target apache --level 2