STIGQter: STIG Summary: APACHE 2.2 Server for UNIX Security Technical Implementation Guide Version: 1 Release: 11 Benchmark Date: 25 Jan 2019:

The process ID (PID) file must be properly secured.

DISA Rule

SV-33222r1_rule

Vulnerability Number

V-26305

Group Title

WA00530

Rule Version

WA00530 A22

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Modify the location, permissions, and/or ownership for the PID file folder.

Check Contents

Enter the following command:

more /usr/local/Apache2.2/conf/httpd.conf.

Review the httpd.conf file and search for the following uncommented directive: PidFile
Note the location and name of the PID file.
If the PidFile directive is not found enabled in the conf file, use /logs as the directory containing the Scoreboard file.
Verify the permissions and ownership on the folder containing the PID file. If any user accounts other than root, auditor, or the account used to run the web server have permission to, or ownership of, this folder, this is a finding. If the PID file is located in the web server DocumentRoot this is a finding.

Vulnerability Number

V-26305

Documentable

False

Rule Version

WA00530 A22

Severity Override Guidance

Enter the following command:

more /usr/local/Apache2.2/conf/httpd.conf.

Review the httpd.conf file and search for the following uncommented directive: PidFile
Note the location and name of the PID file.
If the PidFile directive is not found enabled in the conf file, use /logs as the directory containing the Scoreboard file.
Verify the permissions and ownership on the folder containing the PID file. If any user accounts other than root, auditor, or the account used to run the web server have permission to, or ownership of, this folder, this is a finding. If the PID file is located in the web server DocumentRoot this is a finding.

Check Content Reference

M

Responsibility

Web Administrator

Target Key

158

Comments