TMAegis
Više pravila za apache

TMA-APACHE-9.4

Ensure KeepAliveTimeout is Set to a Value of 15 or Less

SrednjaNivo 1Automatskaapache

Opis

The KeepAliveTimeout directive specifies the number of seconds Apache will wait for a subsequent request before closing a connection that is being kept alive. Every KeepAliveTimeout must be 15 or less (absent means the default 5). Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

Kako se proverava

Metod provere: Komanda ljuske

shell
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk 'tolower($1)=="keepalivetimeout"{n++; v=$2+0; if(!(v<=15)) bad=1} END{print (!bad)?"compliant":"noncompliant"}'
Očekivani izlaz
compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Set KeepAliveTimeout 15 (or lower). Then run apachectl configtest and reload Apache.

Svojstva

Operativni sistemi
Bilo koji
Oznake
apachedos
Referenca
CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 9.4 Ensure KeepAliveTimeout is Set to a Value of 15 or Less

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell
tmaegis scan --target apache