STIGQter: STIG Summary: Apache Server 2.4 UNIX Server Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

Warning and error messages displayed to clients must be modified to minimize the identity of the Apache web server, patches, loaded modules, and directory paths.

DISA Rule

SV-214256r961167_rule

Vulnerability Number

V-214256

Group Title

SRG-APP-000266-WSR-000159

Rule Version

AS24-U1-000620

Severity

CAT II

CCI(s)

CCI-001312 - Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited.

Weight

Fix Recommendation

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file:

# apachectl -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"
-D SERVER_CONFIG_FILE="conf/httpd.conf"

Use the "ErrorDocument" directive to enable custom error pages for 4xx or 5xx HTTP status codes.

ErrorDocument 500 "Sorry, our script crashed. Oh dear"
ErrorDocument 500 /cgi-bin/crash-recover
ErrorDocument 500 http://error.example.com/server_error.html
ErrorDocument 404 /errors/not_found.html
ErrorDocument 401 /subscription/how_to_subscribe.html

The syntax of the ErrorDocument directive is:

ErrorDocument <3-digit-code> <action>

Additional information:

https://httpd.apache.org/docs/2.4/custom-error.html

Check Contents

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file:

# apachectl -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"
-D SERVER_CONFIG_FILE="conf/httpd.conf"

Note: The apachectl front end is the preferred method for locating the Apache httpd file. For some Linux distributions, "apache2ctl -V" or "httpd -V" can also be used.

# cat /<path_to_file>/httpd.conf | grep -i "ErrorDocument"

If the "ErrorDocument" directive is not being used for custom error pages for "4xx" or "5xx" HTTP status codes, this is a finding.

Note: Using a "sites-available" method for error messages is also acceptable; this would involve the use of /etc/apache2/sites-available and /etc/apache2/sites-enabled. As long as warning and error messages have been sanitized, this is not a finding.

Vulnerability Number

V-214256

Documentable

False

Rule Version

AS24-U1-000620

Severity Override Guidance

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file:

# apachectl -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"
-D SERVER_CONFIG_FILE="conf/httpd.conf"

Note: The apachectl front end is the preferred method for locating the Apache httpd file. For some Linux distributions, "apache2ctl -V" or "httpd -V" can also be used.

# cat /<path_to_file>/httpd.conf | grep -i "ErrorDocument"

If the "ErrorDocument" directive is not being used for custom error pages for "4xx" or "5xx" HTTP status codes, this is a finding.

Note: Using a "sites-available" method for error messages is also acceptable; this would involve the use of /etc/apache2/sites-available and /etc/apache2/sites-enabled. As long as warning and error messages have been sanitized, this is not a finding.

Check Content Reference

Target Key

3996