STIGQter: STIG Summary: Apache Server 2.4 UNIX Site Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

The Apache web server must display a default hosted application web page, not a directory listing, when a requested web page cannot be found.

DISA Rule

SV-214292r612241_rule

Vulnerability Number

V-214292

Group Title

SRG-APP-000266-WSR-000142

Rule Version

AS24-U2-000620

Severity

CAT II

CCI(s)

• CCI-001312 - The information system generates error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

Weight

10

Fix Recommendation

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file:

# httpd -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"
-D SERVER_CONFIG_FILE="conf/httpd.conf"

Add a default document to the applicable directories.

Check Contents

View the "DocumentRoot" value by entering the following command:

awk '{print $1,$2,$3}' <'INSTALL PATH'>/conf/httpd.conf|grep -i DocumentRoot|grep -v '^#'

Note each location following the "DocumentRoot" string. This is the configured path(s) to the document root directory(s).

To view a list of the directories and subdirectories and the file "index.html", from each stated "DocumentRoot" location enter the following commands:

find . -type d
find . -type f -name index.html

Review the results for each document root directory and its subdirectories.

If a directory does not contain an "index.html" or equivalent default document, this is a finding.

Vulnerability Number

V-214292

Documentable

False

Rule Version

AS24-U2-000620

Severity Override Guidance

View the "DocumentRoot" value by entering the following command:

awk '{print $1,$2,$3}' <'INSTALL PATH'>/conf/httpd.conf|grep -i DocumentRoot|grep -v '^#'

Note each location following the "DocumentRoot" string. This is the configured path(s) to the document root directory(s).

To view a list of the directories and subdirectories and the file "index.html", from each stated "DocumentRoot" location enter the following commands:

find . -type d
find . -type f -name index.html

Review the results for each document root directory and its subdirectories.

If a directory does not contain an "index.html" or equivalent default document, this is a finding.

Check Content Reference

M

Target Key

3997

Comments