TMA-APACHE-9.1
Ensure the TimeOut Is Set to 10 or Less
Açıklama
Denial of Service (DoS) is an attack technique with the intent of preventing a web site from serving normal user activity. DoS attacks, which are normally applied to the network layer, are also possible at the application layer. These malicious attacks can succeed by starving a system of critical resources, vulnerability exploit, or abuse of functionality. The effective (last) Timeout must be 1-10 seconds; the default 60 fails. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file.
Nasıl denetlenir
Denetim yöntemi: Kabuk komutu
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; printf '%s\n' "$cfg" | awk 'tolower($1)=="timeout"{n=1; v=$2+0} END{print (n && (v>=1 && v<=10))?"compliant":"noncompliant"}'- Beklenen çıktı
compliant
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
Set Timeout 10 in the main configuration. Then run apachectl configtest and reload Apache.
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- apachedos
- Referans
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 9.1 Ensure the TimeOut Is Set to 10 or Less
Bu ana makineyi denetle
Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.
tmaegis scan --target apache