STIGQter: STIG Summary: Oracle HTTP Server 12.1.3 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 24 Jul 2020:

OHS content and configuration files must be part of a routine backup program.

DISA Rule

SV-79163r1_rule

Vulnerability Number

V-64673

Group Title

SRG-APP-000516-WSR-000174

Rule Version

OH12-1X-000218

Severity

CAT III

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

1. Backup the following files on a regular basis:

a) /etc/oraInst.loc
b) Directory identified by inventory_loc parameter within /etc/oraInst.loc
c) /etc/cap.ora
d) $MW_HOME

2. Perform a restore and start the restored OHS server on a test machine.

3. Test the functionality of the restored OHS software on the test machine.

Check Contents

1. Check that the following files and directories are backed up on a regular basis:

a) /etc/oraInst.loc
b) Directory identified by inventory_loc parameter within /etc/oraInst.loc
c) /etc/cap.ora
d) $MW_HOME

2. Confirm the ability to restore the above files and directories successfully.

3. Confirm the successful operation of OHS upon a successful restoration of the files and directories.

4. If the files aren't backed up on a regular schedule or the backups haven't been tested, this is a finding.

Vulnerability Number

V-64673

Documentable

False

Rule Version

OH12-1X-000218

Severity Override Guidance

1. Check that the following files and directories are backed up on a regular basis:

a) /etc/oraInst.loc
b) Directory identified by inventory_loc parameter within /etc/oraInst.loc
c) /etc/cap.ora
d) $MW_HOME

2. Confirm the ability to restore the above files and directories successfully.

3. Confirm the successful operation of OHS upon a successful restoration of the files and directories.

4. If the files aren't backed up on a regular schedule or the backups haven't been tested, this is a finding.

Check Content Reference

M

Target Key

2753

Comments