TMA-APACHE-10.3
Ensure the LimitRequestFieldsize Directive is Set to 8190 or Less
DüşükDüzey 2Otomatikapache
Açıklama
The LimitRequestFieldSize limits the number of bytes that will be allowed in an HTTP request header. It is recommended that the LimitRequestFieldSize directive be set to the default value of 8190 or less. LimitRequestFieldSize must be set and every value must be 8190 or less. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.
Nasıl denetlenir
Denetim yöntemi: Kabuk komutu
shell
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk 'tolower($1)=="limitrequestfieldsize"{n++; v=$2+0; if(!(v<=8190)) bad=1} END{print (n>0&&!bad)?"compliant":"noncompliant"}'- Beklenen çıktı
compliant
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
Set LimitRequestFieldSize 8190 (or lower). Then run apachectl configtest and reload Apache.
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- apacherequest-limits
- Referans
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 10.3 Ensure the LimitRequestFieldsize Directive is Set to 8190 or Less
Bu ana makineyi denetle
Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.
shell
tmaegis scan --target apache --level 2