STIGQter STIGQter: STIG Summary: APACHE 2.2 Server for Windows Security Technical Implementation Guide Version: 1 Release: 13 Benchmark Date: 25 Jan 2019:

Active software modules must be minimized.

DISA Rule

SV-33167r1_rule

Vulnerability Number

V-26285

Group Title

WA00500

Rule Version

WA00500 W22

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Disable any modules that are not needed by adding a "#" in front of them within the httpd.conf file, and restarting the Apache httpd service.

Check Contents

Open a command prompt window.

Navigate to the “bin” directory (in many cases this may be [Drive Letter]:\[directory path]\Apache Software Foundation\Apache2.2\bin>).

Enter the following command and press Enter: httpd –M

This will provide a list of the loaded modules. Discuss with the web administrator why all displayed modules are required for operation. If any module is not required for operation, this is a finding.

Note: The following modules do not need to be discussed: core_module, win32_module, mpm_winnt_module, http_module, so_module.

Vulnerability Number

V-26285

Documentable

False

Rule Version

WA00500 W22

Severity Override Guidance

Open a command prompt window.

Navigate to the “bin” directory (in many cases this may be [Drive Letter]:\[directory path]\Apache Software Foundation\Apache2.2\bin>).

Enter the following command and press Enter: httpd –M

This will provide a list of the loaded modules. Discuss with the web administrator why all displayed modules are required for operation. If any module is not required for operation, this is a finding.

Note: The following modules do not need to be discussed: core_module, win32_module, mpm_winnt_module, http_module, so_module.

Check Content Reference

M

Responsibility

Web Administrator

Target Key

158

Comments