STIGQter STIGQter: STIG Summary: APACHE 2.2 Site for UNIX Security Technical Implementation Guide Version: 1 Release: 11 Benchmark Date: 25 Jan 2019:

Symbolic links must not be used in the web content directory tree.

DISA Rule

SV-30576r1_rule

Vulnerability Number

V-2227

Group Title

WG360

Rule Version

WG360 A22

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Disable symbolic links.

Check Contents

Locate the directories containing the web content, (i.e., /usr/local/apache/htdocs).

Use ls –al.

An entry, such as the following, would indicate the presence and use of symbolic links:

lr-xr—r-- 4000 wwwusr wwwgrp 2345 Apr 15 data -> /usr/local/apache/htdocs

Such a result found in a web document directory is a finding. Additional Apache configuration check in the httpd.conf file:

<Directory /[website root dir]>
Options FollowSymLinks
AllowOverride None
</Directory>

The above configuration is incorrect and is a finding. The correct configuration is:

<Directory /[website root dir]>
Options SymLinksIfOwnerMatch
AllowOverride None
</Directory>

Finally, the target file or directory must be owned by the same owner as the link, which should be a privileged account with access to the web content.

Vulnerability Number

V-2227

Documentable

False

Rule Version

WG360 A22

Severity Override Guidance

Locate the directories containing the web content, (i.e., /usr/local/apache/htdocs).

Use ls –al.

An entry, such as the following, would indicate the presence and use of symbolic links:

lr-xr—r-- 4000 wwwusr wwwgrp 2345 Apr 15 data -> /usr/local/apache/htdocs

Such a result found in a web document directory is a finding. Additional Apache configuration check in the httpd.conf file:

<Directory /[website root dir]>
Options FollowSymLinks
AllowOverride None
</Directory>

The above configuration is incorrect and is a finding. The correct configuration is:

<Directory /[website root dir]>
Options SymLinksIfOwnerMatch
AllowOverride None
</Directory>

Finally, the target file or directory must be owned by the same owner as the link, which should be a privileged account with access to the web content.

Check Content Reference

M

Responsibility

System Administrator

Target Key

161

Comments