Apache HTTP Server
TMA-APACHE-7.7
Ensure SSL Compression is not Enabled
Опис
The SSLCompression directive controls whether SSL compression is used by Apache when serving content over HTTPS. It is recommended that the SSLCompression directive be set to off. SSLCompression must be absent or off (CRIME). Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file. CIS marks this recommendation Manual; the automated check implements its audit procedure.
Како се проверава
Метод провере: Команда љуске
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk 'tolower($1)=="sslcompression" && tolower($2)!="off"{bad=1} END{print bad?"noncompliant":"compliant"}'- Очекивани излаз
compliant
Како се исправља
Метод исправке: Смерница или закрпа инфраструктуре
Remove SSLCompression on (or set SSLCompression off). Then run apachectl configtest and reload Apache.
Својства
- Оперативни системи
- Било који
- Ознаке
- apachetls
- Референца
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 7.7 Ensure SSL Compression is not Enabled
Проверите овај рачунар
Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.
tmaegis scan --target apache