STIGQter STIGQter: STIG Summary: Apache Server 2.4 UNIX Server Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

The Apache web server htpasswd files (if present) must reflect proper ownership and permissions.

DISA Rule

SV-214274r1212183_rule

Vulnerability Number

V-214274

Group Title

SRG-APP-000516-WSR-000174

Rule Version

AS24-U1-000970

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Find the htpasswd file using the AuthUserFile directive:

cat /<path_to_file>/httpd.conf | grep -i "AuthUserFile" | awk '{print $2}'

Ensure the SA or web manager account owns the htpasswd file.

Ensure permissions are set to "550".

Check Contents

Locate the htpasswd file using the AuthUserFile directive by entering the following command:

cat /<path_to_file>/httpd.conf | grep -i "AuthUserFile" | awk '{print $2}'

If the above command produces any output, run the "ls -l" command on it; for example:

ls -l /etc/httpd/.htpasswd

Permissions should be: r-x r - x - - - (550)

If permissions on the password file are greater than "550", this is a finding.

Verify the owner is the SA or web manager account.

If another account has access to this file, this is a finding.

Vulnerability Number

V-214274

Documentable

False

Rule Version

AS24-U1-000970

Severity Override Guidance

Locate the htpasswd file using the AuthUserFile directive by entering the following command:

cat /<path_to_file>/httpd.conf | grep -i "AuthUserFile" | awk '{print $2}'

If the above command produces any output, run the "ls -l" command on it; for example:

ls -l /etc/httpd/.htpasswd

Permissions should be: r-x r - x - - - (550)

If permissions on the password file are greater than "550", this is a finding.

Verify the owner is the SA or web manager account.

If another account has access to this file, this is a finding.

Check Content Reference

M

Target Key

3996