TMAegisБета
Више правила за apache

Apache HTTP Server

TMA-APACHE-6.1

Ensure the Error Log Filename and Severity Level Are Configured Correctly

СредњаНиво 1Аутоматскаapache

Опис

The LogLevel directive is used to configure the severity level for the error logs. While the ErrorLog directive configures the error log file name. The log level values are the standard syslog levels of emerg, alert, crit, error, warn, notice, info and debug. The recommended level is notice for most modules, so that all errors from the emerg level through notice level will be logged. The global LogLevel must be notice or more verbose and the core module info or more verbose (e.g. LogLevel notice core:info; the default warn fails), and a global ErrorLog must be configured. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

Како се проверава

Метод провере: Команда љуске

shell
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk 'BEGIN{split("emerg alert crit error warn notice info debug",L," "); for(i in L) rk[L[i]]=i} {l=tolower($0)} l~/^<virtualhost/{vh=1} l~/^<\/virtualhost>/{vh=0} !vh && $1~/^[Ll]og[Ll]evel$/{m=""; c=""; for(i=2;i<=NF;i++){t=tolower($i); if(t~/^core:/){c=substr(t,6)} else if(t!~/:/){m=t}} if(m!="") main=m; if(c!="") core=c} !vh && tolower($1)=="errorlog"{el=1} function r(x){return (x~/^trace[1-8]$/)?9:((x in rk)?rk[x]:0)} END{if(main=="") main="warn"; if(core=="") core=main; print (el && r(main)>=6 && r(core)>=7)?"compliant":"noncompliant"}'
Очекивани излаз
compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Set LogLevel notice core:info and ErrorLog "logs/error_log" (or syslog:local1) in the main configuration. Then run apachectl configtest and reload Apache.

Својства

Оперативни системи
Било који
Ознаке
apachelogging
Референца
CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 6.1 Ensure the Error Log Filename and Severity Level Are Configured Correctly

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell
tmaegis scan --target apache