Ensure Access to Special Purpose Application Writable Directories is Properly Restricted

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

Perform the following to determine if the recommended state is implemented: 1. Single Purpose Directory - For each application writable directory review the documented purpose for the directory to confirm the directory serves a single purpose. 2. Outside the Configured Web DocumentRoot - For each writable directory and it's corresponding DocumentRoot perform the following. No output from the find command indicates the directory is not within the DocumentRoot.

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Perform the following: 1. Single Purpose Directory - Create separate directories of the multipurpose directory, and adjust the application configuration and directory ownership and permissions appropriately. 2. Outside the Configured Web DocumentRoot - Move the writable directory to a more suitable location NOT under the DocumentRoot directory. A location within the /var/ filesystem may be a good choice for changeable data. 3. Owned by the root User or an Administrator Account - Change the ownership to root or an administrator. chown root $WR_DIR 4. Not writable by Other - Remove the other write permissions, use group write or ACLs to provide the least privileges necessary. chmod o-w $WR_DIR