STIGQter: STIG Summary: APACHE 2.2 Site for Windows Security Technical Implementation Guide Version: 1 Release: 13 Benchmark Date: 25 Jan 2019:

Access to the web server log files must be restricted to Administrators, the user assigned to run the web server software, Web Manager, and Auditors.

DISA Rule

SV-40832r1_rule

Vulnerability Number

V-13689

Group Title

WG255

Rule Version

WG255 W22

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

To ensure the integrity of the data that is being captured in the log files, ensure that only the members of the Auditors group, Administrators, and the user assigned to run the web server software is granted permissions to read the log files.

Check Contents

Determine permissions for log files

Find the httpd.conf configuration file to determine the location of the log files. The location is indicated at the "ServerRoot" directive. The log directory is a sub-directory under the ServerRoot.

ex. :\Apache Group\Apache2\logs or :\Apache Software Foundation\Apache2.2\logs

After locating the logs, use the Explorer to move to these files and examine their properties:

Properties >> Security >> Permissions.

Administrators: Read
Auditors: Full Control
Web Managers: Read
WebServer Account: Read/Write/Execute

If anyone other than the Auditors, Administrators, Web Managers, or the account that runs the web server has access to the log files, this is a finding.

Vulnerability Number

V-13689

Documentable

False

Rule Version

WG255 W22

Severity Override Guidance

Determine permissions for log files

Find the httpd.conf configuration file to determine the location of the log files. The location is indicated at the "ServerRoot" directive. The log directory is a sub-directory under the ServerRoot.

ex. :\Apache Group\Apache2\logs or :\Apache Software Foundation\Apache2.2\logs

After locating the logs, use the Explorer to move to these files and examine their properties:

Properties >> Security >> Permissions.

Administrators: Read
Auditors: Full Control
Web Managers: Read
WebServer Account: Read/Write/Execute

If anyone other than the Auditors, Administrators, Web Managers, or the account that runs the web server has access to the log files, this is a finding.

Check Content Reference

M

Responsibility

Web Administrator

Target Key

161

Comments