Ensure Access to OS Root Directory Is Denied By Default

YüksekDüzey 1Otomatikapache

Açıklama

The Apache Directory directive allows for directory specific configuration of access controls and many other features and options. One important usage is to create a default deny policy that does not allow access to operating system directories and files, except for those specifically allowed. This is done by denying access to the OS root directory. The <Directory /> block must contain a single "Require all denied" and no Allow/Deny (or the legacy Order deny,allow + Deny from all with no Allow/Require). Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk '{l=tolower($0); $0=l} /^<directory[[:space:]]/{dd++; if(dd==1){x=$2; gsub(/[">]/,"",x); r=(x=="/"); if(r) f=1}; next} /^<\/directory>/{dd--; if(dd==0) r=0; next} r && $1=="require"{nr++; if($0~/^require[[:space:]]+all[[:space:]]+denied/) rd++} r && $1=="allow"{al++} r && $1=="deny"{dn++; if($0~/from[[:space:]]+all/) dfa=1} r && $1=="order"{no++; if($0~/deny,[[:space:]]*allow/) oda=1} END{print (f && ((nr==1&&rd==1&&al==0&&dn==0) || (no==1&&oda&&dfa&&al==0&&nr==0)))?"compliant":"noncompliant"}'

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

In the main configuration: <Directory /> ... Require all denied ... </Directory> (remove Allow/Deny/other Require lines). Then run apachectl configtest and reload Apache.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: apacheaccess-control
Referans: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 4.1 Ensure Access to OS Root Directory Is Denied By Default

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target apache