TMA-APACHE-7.3
Ensure the Server's Private Key Is Protected
Açıklama
It is critical to protect the server's private key. The server's private key is encrypted by default as a means of protecting it. However, having it encrypted means that the passphrase is required each time the server is started up, and now it is necessary to protect the passphrase as well. The passphrase may be typed in when it is manually started up or provided by an automated program. Every SSLCertificateKeyFile (and any SSLCertificateFile that embeds a PRIVATE KEY) must be owned by root:root with mode 0400. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file. CIS marks this recommendation Manual; the automated check implements its audit procedure.
Nasıl denetlenir
Denetim yöntemi: Kabuk komutu
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; bad=0; n=0; while read -r k f; do f=${f//\"/}; case $f in /*) ;; *) f=$R/$f;; esac; [ -e "$f" ] || continue; if [ "$k" = c ]; then grep -q 'PRIVATE KEY' "$f" 2>/dev/null || continue; fi; n=$((n+1)); o=$(stat -Lc '%U:%G' "$f"); [ "$o" = root:root ] && [ -z "$(find -L "$f" -perm /377)" ] || bad=1; done < <(printf '%s\n' "$cfg" | awk 'tolower($1)=="sslcertificatekeyfile"{print "k", $2} tolower($1)=="sslcertificatefile"{print "c", $2}'); [ "$bad" = 0 ] && echo compliant || echo noncompliant- Beklenen çıktı
compliant
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
chown root:root <keyfile>; chmod 0400 <keyfile> for every SSLCertificateKeyFile.
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- apachetls
- Referans
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 7.3 Ensure the Server's Private Key Is Protected
Bu ana makineyi denetle
Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.
tmaegis scan --target apache