Ensure Options for Other Directories Are Minimized

NiskaNivo 2Automatskaapache

Opis

The Apache Options directive allows for specific configuration of options, including execution of CGI, following symbolic links, server side includes, and content negotiation. No Options directive inside a <Directory> block may enable Includes, IncludesNOEXEC or All. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

Kako se proverava

Metod provere: Komanda ljuske

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk '/^<[Dd]irectory/{dd=1; next} /^<\/[Dd]irectory>/{dd=0; next} dd && tolower($1)=="options"{for(i=2;i<=NF;i++){t=tolower($i); if(t~/^\+?includes(noexec)?$/ || t~/^\+?all$/) bad=1}} END{print bad?"noncompliant":"compliant"}'

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Remove Includes (and All) from Options in every <Directory> block; use only the options each directory needs. Then run apachectl configtest and reload Apache.

Svojstva

Operativni sistemi: Bilo koji
Oznake: apachefeatures
Referenca: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 5.3 Ensure Options for Other Directories Are Minimized

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target apache --level 2