STIGQter: STIG Summary: Apache Server 2.4 Windows Server Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020: STIGQter: STIG Summary: Apache Server 2.4 Windows Server Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:SV-214315r505936_rule
V-214315
SRG-APP-000120-WSR-000070
AS24-W1-000200
CAT II
10
Obtain the log location by reviewing the <'INSTALL PATH'>\conf\httpd.conf file.
Click the "Browse" button and navigate to the directory where the log files are stored.
Right-click the log file name to review and click "Properties".
Click the "Security" tab.
Set the log file permissions for the appropriate group(s).
Click "OK".
Select "Apply" in the "Actions" pane.
Query the System Administrator (SA) to determine who has update access to the web server log files.
The role of auditor and the role of SA should be distinctly separate. An individual functioning as an auditor should not also serve as an SA due to a conflict of interest.
Only management-authorized individuals with a privileged ID or group ID associated with an auditor role will have access permission to log files that are greater than read on web servers he or she has been authorized to audit.
Only management-authorized individuals with a privileged ID or group ID associated with either an SA or Web Administrator role may have read authority to log files for the web servers he or she has been authorized to administer.
If an account with roles other than auditor has greater than read authority to the log files, this is a finding.
Obtain the log location by reviewing the <'INSTALL PATH'>\conf\httpd.conf file.
Click the "Browse" button and navigate to the directory where the log files are stored.
Right-click the log file name to review and click "Properties".
Click the "Security" tab.
If an account associated with roles other than auditors, SAs, or Web Administrators has any access to log files, this is a finding.
If an account with roles other than auditor has greater than read authority to the log files, this is a finding.
This check does not apply to service account IDs used by automated services necessary to process, manage, and store log files.
V-214315
False
AS24-W1-000200
Query the System Administrator (SA) to determine who has update access to the web server log files.
The role of auditor and the role of SA should be distinctly separate. An individual functioning as an auditor should not also serve as an SA due to a conflict of interest.
Only management-authorized individuals with a privileged ID or group ID associated with an auditor role will have access permission to log files that are greater than read on web servers he or she has been authorized to audit.
Only management-authorized individuals with a privileged ID or group ID associated with either an SA or Web Administrator role may have read authority to log files for the web servers he or she has been authorized to administer.
If an account with roles other than auditor has greater than read authority to the log files, this is a finding.
Obtain the log location by reviewing the <'INSTALL PATH'>\conf\httpd.conf file.
Click the "Browse" button and navigate to the directory where the log files are stored.
Right-click the log file name to review and click "Properties".
Click the "Security" tab.
If an account associated with roles other than auditors, SAs, or Web Administrators has any access to log files, this is a finding.
If an account with roles other than auditor has greater than read authority to the log files, this is a finding.
This check does not apply to service account IDs used by automated services necessary to process, manage, and store log files.
M
3998