TMA-APACHE-9.6
Ensure Timeout Limits for the Request Body is Set to 20 or Less
Mô tả
The RequestReadTimeout directive also allows setting timeout values for the body portion of a request. The directive provides for an initial timeout value, and a maximum timeout and minimum rate. The minimum rate specifies that after the initial timeout, the server will wait an additional 1 second for each N bytes received. The recommended setting is to have a maximum timeout of 20 seconds or less. Every RequestReadTimeout must limit the body timeout to 20 seconds or less (upper bound of a range); without RequestReadTimeout the mod_reqtimeout default (body=20) is compliant when the module is loaded. Reads the main configuration (APACHE_CONF overrides; default /etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf or /usr/local/apache2/conf/httpd.conf) and every Include/IncludeOptional file. Uses the module list from apachectl -M (apache2ctl/httpd; needs root). CIS marks this recommendation Manual; the automated check implements its audit procedure.
Cách kiểm tra
Phương pháp kiểm tra: Lệnh shell
c=${APACHE_CONF:-}; if [ -z "$c" ]; then for f in /etc/apache2/apache2.conf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf /etc/apache2/httpd.conf; do [ -f "$f" ] && { c=$f; break; }; done; fi; [ -r "$c" ] || exit 1; R=$(awk 'tolower($1)=="serverroot"{v=$2; gsub(/"/,"",v); print v; exit}' "$c"); [ -n "$R" ] || R=$(dirname "$c"); shopt -s nocasematch; inc(){ local p g l; [ ${#FUNCNAME[@]} -lt 16 ] || return 0; p=$1; case $p in /*) ;; *) p=$R/$p;; esac; [ -d "$p" ] && p="$p/*"; for g in $p; do [ -f "$g" ] || continue; while IFS= read -r l || [ -n "$l" ]; do if [[ $l =~ ^[[:space:]]*include(optional)?[[:space:]]+\"?([^\"[:space:]]+) ]]; then inc "${BASH_REMATCH[2]}"; else printf '%s\n' "$l"; fi; done < "$g"; done; }; cfg=$(inc "$c" | sed -e 's/^[[:space:]]*//' -e '/^#/d' -e '/^$/d'); shopt -u nocasematch; b=$(command -v apache2ctl || command -v apachectl || command -v httpd) || exit 1; m=$("$b" ${APACHE_CONF:+-f "$APACHE_CONF"} -M 2>/dev/null) || exit 1; printf '%s\n' "$m" | grep -q reqtimeout_module && r=1 || r=0; printf '%s\n' "$cfg" | awk -v r="$r" 'tolower($1)=="requestreadtimeout"{n++; for(i=2;i<=NF;i++){t=tolower($i); if(t~/^body=/){x=t; sub(/^[a-z]+=/,"",x); sub(/,.*/,"",x); k=split(x,y,"-"); if(y[k]+0>20 || y[k]+0==0) bad=1}}} END{print ((n>0 && !bad) || (n==0 && r))?"compliant":"noncompliant"}'- Đầu ra mong đợi
compliant
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Load mod_reqtimeout and set e.g. RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500. Then run apachectl configtest and reload Apache.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- apachedos
- Tham chiếu
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 9.6 Ensure Timeout Limits for the Request Body is Set to 20 or Less
Kiểm tra máy này
Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.
tmaegis scan --target apache