STIGQter: STIG Summary: Apache Server 2.4 UNIX Server Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 22 Jan 2021:

Debugging and trace information used to diagnose the Apache web server must be disabled.

DISA Rule

SV-214257r612240_rule

Vulnerability Number

V-214257

Group Title

SRG-APP-000266-WSR-000160

Rule Version

AS24-U1-000630

Severity

CAT II

CCI(s)

• CCI-001312 - The information system generates error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

Weight

10

Fix Recommendation

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file:

# httpd -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"
-D SERVER_CONFIG_FILE="conf/httpd.conf"

Add or set the value of "TraceEnable" to "Off".

Set the "LogLevel" directive to "info" or below.

Check Contents

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file:

# httpd -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"
-D SERVER_CONFIG_FILE="conf/httpd.conf"

For any enabled "TraceEnable" directives, verify they are part of the server-level configuration (i.e., not nested in a "Directory" or "Location" directive).

Verify that the "TraceEnable" directive is set to "Off":

# cat /<path_to_file>/httpd.conf | grep -i "TraceEnable"

If the "TraceEnable" directive is not part of the server-level configuration and/or is not set to "Off", this is a finding.

If the directive does not exist in the "conf" file, this is a finding because the default value is "On".

If the "LogLevel" directive is not being used, this is a finding:

# cat /<path_to_file>/httpd.conf | grep -i "LogLevel"

Vulnerability Number

V-214257

Documentable

False

Rule Version

AS24-U1-000630

Severity Override Guidance

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file:

# httpd -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"
-D SERVER_CONFIG_FILE="conf/httpd.conf"

For any enabled "TraceEnable" directives, verify they are part of the server-level configuration (i.e., not nested in a "Directory" or "Location" directive).

Verify that the "TraceEnable" directive is set to "Off":

# cat /<path_to_file>/httpd.conf | grep -i "TraceEnable"

If the "TraceEnable" directive is not part of the server-level configuration and/or is not set to "Off", this is a finding.

If the directive does not exist in the "conf" file, this is a finding because the default value is "On".

If the "LogLevel" directive is not being used, this is a finding:

# cat /<path_to_file>/httpd.conf | grep -i "LogLevel"

Check Content Reference

M

Target Key

3996

Comments