STIGQter: STIG Summary: Apache Server 2.4 UNIX Server Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 22 Jan 2021:

The account used to run the Apache web server must not have a valid login shell and password defined.

DISA Rule

SV-214271r612240_rule

Vulnerability Number

V-214271

Group Title

SRG-APP-000516-WSR-000079

Rule Version

AS24-U1-000940

Severity

CAT I

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Update the /etc/passwd file to assign the account used to run the "httpd" process an invalid login shell such as "/sbin/nologin".

Lock the account used to run the "httpd" process:

# passwd -l <account>
Locking password for user <account>
passwd: Success

Check Contents

Identify the account that is running the "httpd" process:
# ps -ef | grep -i httpd | grep -v grep

apache 29613 996 0 Feb17 ? 00:00:00 /usr/sbin/httpd
apache 29614 996 0 Feb17 ? 00:00:00 /usr/sbin/httpd

Check to see if the account has a valid login shell:

# cut -d: -f1,7 /etc/passwd | grep -i <service_account>
apache:/sbin/nologin

If the service account has a valid login shell, verify that no password is configured for the account:

# cut -d: -f1,2 /etc/shadow | grep -i <service_account>
apache:!!

If the account has a valid login shell and a password defined, this is a finding.

Vulnerability Number

V-214271

Documentable

False

Rule Version

AS24-U1-000940

Severity Override Guidance

Identify the account that is running the "httpd" process:
# ps -ef | grep -i httpd | grep -v grep

apache 29613 996 0 Feb17 ? 00:00:00 /usr/sbin/httpd
apache 29614 996 0 Feb17 ? 00:00:00 /usr/sbin/httpd

Check to see if the account has a valid login shell:

# cut -d: -f1,7 /etc/passwd | grep -i <service_account>
apache:/sbin/nologin

If the service account has a valid login shell, verify that no password is configured for the account:

# cut -d: -f1,2 /etc/shadow | grep -i <service_account>
apache:!!

If the account has a valid login shell and a password defined, this is a finding.

Check Content Reference

M

Target Key

3996

Comments