Page 3
2.8 Ensure the Info Module Is Disabled (Automated) .................................................................................. 34
2.9 Ensure the Basic and Digest Authentication Modules are Disabled (Automated)................................. 36
3 Principles, Permissions, and Ownership ........................................................................... 39
3.1 Ensure the Apache Web Server Runs As a Non-Root User (Automated) ............................................ 40
3.2 Ensure the Apache User Account Has an Invalid Shell (Automated).................................................... 43
3.3 Ensure the Apache User Account Is Locked (Automated) .................................................................... 45
3.4 Ensure Apache Directories and Files Are Owned By Root (Automated) .............................................. 47
3.5 Ensure the Group Is Set Correctly on Apache Directories and Files (Automated)................................ 49
3.6 Ensure Other Write Access on Apache Directories and Files Is Restricted (Automated) ..................... 51
3.7 Ensure the Core Dump Directory Is Secured (Automated) ................................................................... 53
3.8 Ensure the Lock File Is Secured (Automated) ....................................................................................... 55
3.9 Ensure the Pid File Is Secured (Automated) ......................................................................................... 57
3.10 Ensure the ScoreBoard File Is Secured (Automated) ......................................................................... 59
3.11 Ensure Group Write Access for the Apache Directories and Files Is Properly Restricted (Automated)
.................................................................................................................................................................... 61
3.12 Ensure Group Write Access for the Document Root Directories and Files Is Properly Restricted
(Automated) ................................................................................................................................................. 63
3.13 Ensure Access to Special Purpose Application Writable Directories is Properly Restricted (Manual) 65
4 Apache Access Control ........................................................................................................ 68
4.1 Ensure Access to OS Root Directory Is Denied By Default (Automated) .............................................. 69
4.2 Ensure Appropriate Access to Web Content Is Allowed (Manual) ........................................................ 72
4.3 Ensure OverRide Is Disabled for the OS Root Directory (Automated) .................................................. 75
4.4 Ensure OverRide Is Disabled for All Directories (Automated) ............................................................... 77
5 Minimize Features, Content and Options ........................................................................... 79
5.1 Ensure Options for the OS Root Directory Are Restricted (Automated) ................................................ 80
5.2 Ensure Options for the Web Root Directory Are Restricted (Automated) ............................................. 82
5.3 Ensure Options for Other Directories Are Minimized (Automated) ........................................................ 84
5.4 Ensure Default HTML Content Is Removed (Automated) ..................................................................... 86
5.5 Ensure the Default CGI Content printenv Script Is Removed (Automated) ........................................... 90
5.6 Ensure the Default CGI Content test-cgi Script Is Removed (Automated) ............................................ 92
5.7 Ensure HTTP Request Methods Are Restricted (Automated) ............................................................... 94
5.8 Ensure the HTTP TRACE Method Is Disabled (Automated) ................................................................. 97
5.9 Ensure Old HTTP Protocol Versions Are Disallowed (Automated) ....................................................... 99
5.10 Ensure Access to .ht* Files Is Restricted (Automated) ...................................................................... 101
5.11 Ensure Access to .git Files Is Restricted (Automated) ...................................................................... 103
5.12 Ensure Access to .svn Files Is Restricted (Automated) .................................................................... 105
5.13 Ensure Access to Inappropriate File Extensions Is Restricted (Automated) ..................................... 107
5.14 Ensure IP Address Based Requests Are Disallowed (Automated) ................................................... 109
5.15 Ensure the IP Addresses for Listening for Requests Are Specified (Automated) ............................. 111
5.16 Ensure Browser Framing Is Restricted (Automated) ......................................................................... 113
5.17 Ensure HTTP Header Referrer-Policy is set appropriately (Manual) ................................................ 115
5.18 Ensure HTTP Header Permissions-Policy is set appropriately (Manual) .......................................... 117
6 Operations - Logging, Monitoring and Maintenance ...................................................... 119
6.1 Ensure the Error Log Filename and Severity Level Are Configured Correctly (Automated) ............... 120
6.2 Ensure a Syslog Facility Is Configured for Error Logging (Automated) ............................................... 123
6.3 Ensure the Server Access Log Is Configured Correctly (Automated) ................................................. 125
6.4 Ensure Log Storage and Rotation Is Configured Correctly (Automated) ............................................ 128
6.5 Ensure Applicable Patches Are Applied (Automated) ......................................................................... 131
6.6 Ensure ModSecurity Is Installed and Enabled (Automated) ................................................................ 133
6.7 Ensure the OWASP ModSecurity Core Rule Set Is Installed and Enabled (Automated) .................... 135
