STIGQter: STIG Summary: APACHE 2.2 Site for UNIX Security Technical Implementation Guide Version: 1 Release: 11 Benchmark Date: 25 Jan 2019:

Web client access to the content directories must be restricted to read and execute.

DISA Rule

SV-33027r2_rule

Vulnerability Number

V-2258

Group Title

WG290

Rule Version

WG290 A22

Severity

CAT I

CCI(s)

CCI-000366 - The organization implements the security configuration settings.

Weight

Fix Recommendation

Assign the appropriate permissions to the applicable directories and files using the chmod command.

Check Contents

To view the value of Alias enter the following command:

grep "Alias" /usr/local/apache2/conf/httpd.conf

Alias
ScriptAlias
ScriptAliasMatch

Review the results to determine the location of the files listed above.

Enter the following command to determine the permissions of the above file:

ls -Ll /file-path

The only accounts listed should be the web administrator, developers, and the account assigned to run the apache server service.

If accounts that don’t need access to these directories are listed, this is a finding.

If the permissions assigned to the account for the Apache web server service, or any group to which the Apache web server service belongs, is greater than Read & Execute (R_E), this is a finding.

Web client access to the content directories must be restricted to read and execute.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Responsibility

Target Key

Comments