STIGQter: STIG Summary: Apache Server 2.4 UNIX Site Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

Only authenticated system administrators or the designated PKI Sponsor for the Apache web server must have access to the Apache web servers private key.

DISA Rule

SV-214287r612241_rule

Vulnerability Number

V-214287

Group Title

SRG-APP-000176-WSR-000096

Rule Version

AS24-U2-000390

Severity

CAT II

CCI(s)

• CCI-000186 - The information system, for PKI-based authentication, enforces authorized access to the corresponding private key.

Weight

10

Fix Recommendation

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file:

# httpd -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"
-D SERVER_CONFIG_FILE="conf/httpd.conf"

Based on the " SSLCertificateKeyFile" directive path, configure the Apache web server to ensure only authenticated and authorized users can access the web server's private key.

Check Contents

In a command line, run "httpd -M | grep -i ssl_module".

If the "ssl_module" is not enabled, this is a finding.

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file:

# httpd -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"
-D SERVER_CONFIG_FILE="conf/httpd.conf"

Review the private key path in the "SSLCertificateKeyFile" directive. Verify only authenticated system administrators and the designated PKI Sponsor for the web server can access the web server private key.

If the private key is accessible by unauthenticated or unauthorized users, this is a finding.

Vulnerability Number

V-214287

Documentable

False

Rule Version

AS24-U2-000390

Severity Override Guidance

In a command line, run "httpd -M | grep -i ssl_module".

If the "ssl_module" is not enabled, this is a finding.

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file:

# httpd -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"
-D SERVER_CONFIG_FILE="conf/httpd.conf"

Review the private key path in the "SSLCertificateKeyFile" directive. Verify only authenticated system administrators and the designated PKI Sponsor for the web server can access the web server private key.

If the private key is accessible by unauthenticated or unauthorized users, this is a finding.

Check Content Reference

M

Target Key

3997

Comments