STIGQter: STIG Summary: Apache Server 2.4 UNIX Site Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

The Apache web server must perform RFC 5280-compliant certification path validation.

DISA Rule

SV-214286r612241_rule

Vulnerability Number

V-214286

Group Title

SRG-APP-000175-WSR-000095

Rule Version

AS24-U2-000380

Severity

CAT II

CCI(s)

• CCI-000185 - The information system, for PKI-based authentication, validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.

Weight

10

Fix Recommendation

Determine the location of the "HTTPD_ROOT" directory and the "ssl.conf" file:

# httpd -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"

Edit <'HTTPD_ROOT'>/conf.d/ssl.conf

Set "SSLVerifyClient" to "require".

Set "SSLVerifyDepth" to "1".

SSLVerifyDepth 1

For more information: https://httpd.apache.org/docs/current/mod/ssl_module.html

Check Contents

In a command line, run "httpd -M | grep -i ssl_module".

If the "ssl_module" is not enabled, this is a finding.

Determine the location of the "HTTPD_ROOT" directory and the "ssl.conf" file:

# httpd -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"

Review <'HTTPD_ROOT'>/conf.d/ssl.conf

Verify "SSLVerifyClient" is set to "require":

SSLVerifyClient require

Verify "SSLVerifyDepth" is set to a number greater than "0":

SSLVerifyDepth 1

If "SSLVerifyClient" is not set to "require" or "SSLVerifyDepth" is not set to a number greater than "0", this is a finding.

Vulnerability Number

V-214286

Documentable

False

Rule Version

AS24-U2-000380

Severity Override Guidance

In a command line, run "httpd -M | grep -i ssl_module".

If the "ssl_module" is not enabled, this is a finding.

Determine the location of the "HTTPD_ROOT" directory and the "ssl.conf" file:

# httpd -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"

Review <'HTTPD_ROOT'>/conf.d/ssl.conf

Verify "SSLVerifyClient" is set to "require":

SSLVerifyClient require

Verify "SSLVerifyDepth" is set to a number greater than "0":

SSLVerifyDepth 1

If "SSLVerifyClient" is not set to "require" or "SSLVerifyDepth" is not set to a number greater than "0", this is a finding.

Check Content Reference

M

Target Key

3997

Comments