Ensure HTTP Strict Transport Security Is Enabled

НискаНиво 2Аутоматскаapache

Опис

HTTP Strict Transport Security (HSTS) is an optional web server security policy mechanism specified by an HTTP Server header. The HSTS header allows a server declaration that only HTTPS communication should be used rather than clear text HTTP communication. At least one Header directive must set Strict-Transport-Security and every such header must have max-age of 480 seconds or more. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file. CIS marks this recommendation Manual; the automated check implements its audit procedure.

Како се проверава

Метод провере: Команда љуске

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk '{l=tolower($0)} l~/^header[[:space:]]/ && l~/strict-transport-security/{n++; m=0; if(match(l,/max-age=[0-9]+/)) m=substr(l,RSTART+8,RLENGTH-8)+0; if(m<480) bad=1} END{print (n>0&&!bad)?"compliant":"noncompliant"}'

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Header always set Strict-Transport-Security "max-age=600" (at server level and in each TLS virtual host). Then run apachectl configtest and reload Apache.

Својства

Оперативни системи: Било који
Ознаке: apachetlsheaders
Референца: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 7.11 Ensure HTTP Strict Transport Security Is Enabled

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target apache --level 2