Ensure HTTP Request Methods Are Restricted

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

Perform the following to determine if the recommended state is implemented: Locate the Apache configuration files and included configuration files. Search for all <Directory> directives other than the OS root directory. Ensure that either one of the following three methods are configured: Using the deprecated Order/Deny/Allow method: 1. Within each <Directory> section, ensure that there is a single <LimitExcept> directive containing a value of Order deny, allow. 2. Verify the <LimitExcept> directive does not include any HTTP methods other than GET, POST, and OPTIONS.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Perform the following to implement the recommended state: 1. Locate the Apache configuration files and included configuration files. 2. Search for the directive on the document root directory such as: <Directory "/usr/local/apache2/htdocs"> . . . </Directory> 3. Add a directive as shown below within the group of document root directives. # Limit HTTP methods to standard methods. Note: Does not limit TRACE <LimitExcept GET POST OPTIONS> Require all denied </LimitExcept> 4. Search for other directives in the Apache configuration files other than the OS root directory and add the same directives to each. It is very important to understand that the directives are based on the OS file system hierarchy as accessed by Apache and not the hierarchy of the locations within web site URLs. <Directory "/usr/local/apache2/cgi-bin"> . . .