Ensure OverRide Is Disabled for the OS Root Directory

SrednjaNivo 1Automatskaapache

Opis

The Apache AllowOverRide directive and the new AllowOverrideList directive allow for .htaccess files to be used to override much of the configuration, including authentication, handling of document types, auto generated indexes, access control, and options. The <Directory /> block must contain a single AllowOverride None and no AllowOverrideList. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

Kako se proverava

Metod provere: Komanda ljuske

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk '{l=tolower($0); $0=l} /^<directory[[:space:]]/{dd++; if(dd==1){x=$2; gsub(/[">]/,"",x); r=(x=="/"); if(r) f=1}; next} /^<\/directory>/{dd--; if(dd==0) r=0; next} r && $1=="allowoverride"{n++; if($2=="none") ok++} r && $1=="allowoverridelist"{bad=1} END{print (f&&n==1&&ok==1&&!bad)?"compliant":"noncompliant"}'

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Set AllowOverride None in the <Directory /> block and remove AllowOverrideList. Then run apachectl configtest and reload Apache.

Svojstva

Operativni sistemi: Bilo koji
Oznake: apacheaccess-control
Referenca: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 4.3 Ensure OverRide Is Disabled for the OS Root Directory

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target apache