STIGQter: STIG Summary: Apache Server 2.4 UNIX Server Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

The Apache web server must use cryptography to protect the integrity of remote sessions.

DISA Rule

SV-214230r1210990_rule

Vulnerability Number

V-214230

Group Title

SRG-APP-000014-WSR-000006

Rule Version

AS24-U1-000030

Severity

CAT II

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
• CCI-000197 - For password-based authentication, transmit passwords only cryptographically-protected channels.
• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
• CCI-001188 - Generate a unique session identifier for each session with organization-defined randomness requirements.
• CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.
• CCI-002418 - Protect the confidentiality and/or integrity of transmitted information.
• CCI-002422 - Maintain the confidentiality and/or integrity of information during reception.
• CCI-002470 - Only allow the use of organization-defined certificate authorities for verification of the establishment of protected sessions.

Weight

10

Fix Recommendation

# cat /etc/httpd/conf.d/ssl.conf | grep "SSLProtocol"

Ensure the "SSLProtocol" is added to the ssl.conf file and looks like the following:

SSLProtocol -SSLv2 -SSLv3 -TLSv1 +TLSv1.2 +TLSv1.3

Restart Apache: apachectl restart

Check Contents

Verify the "ssl module" module is loaded:

# httpd -M | grep -i ssl_module
Output: ssl_module (shared)

If the "ssl_module" is not found, this is a finding.

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file:

# apachectl -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"
-D SERVER_CONFIG_FILE="conf/httpd.conf"

Note: The apachectl front end is the preferred method for locating the Apache httpd file. For some Linux distributions, "apache2ctl -V" or "httpd -V" can also be used.

Search for the directive "SSLProtocol" in the "httpd.conf" file:

# cat /<path_to_file>/httpd.conf | grep -i "SSLProtocol"

If the "SSLProtocol" directive is missing or does not look like the following, this is a finding:

SSLProtocol -SSLv2 -SSLv3 -TLSv1 +TLSv1.2 +TLSv1.3

If the directive does not exist, or exists but does not contain "-SSLv2 -SSLv3 -TLSv1 +TLSv1.2 +TLSv1.3", this is a finding.

Vulnerability Number

V-214230

Documentable

False

Rule Version

AS24-U1-000030

Severity Override Guidance

Verify the "ssl module" module is loaded:

# httpd -M | grep -i ssl_module
Output: ssl_module (shared)

If the "ssl_module" is not found, this is a finding.

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file:

# apachectl -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"
-D SERVER_CONFIG_FILE="conf/httpd.conf"

Note: The apachectl front end is the preferred method for locating the Apache httpd file. For some Linux distributions, "apache2ctl -V" or "httpd -V" can also be used.

Search for the directive "SSLProtocol" in the "httpd.conf" file:

# cat /<path_to_file>/httpd.conf | grep -i "SSLProtocol"

If the "SSLProtocol" directive is missing or does not look like the following, this is a finding:

SSLProtocol -SSLv2 -SSLv3 -TLSv1 +TLSv1.2 +TLSv1.3

If the directive does not exist, or exists but does not contain "-SSLv2 -SSLv3 -TLSv1 +TLSv1.2 +TLSv1.3", this is a finding.

Check Content Reference

M

Target Key

3996