STIGQter STIGQter: STIG Summary: Apache Server 2.4 Windows Server Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The log information from the Apache web server must be protected from unauthorized deletion and modification.

DISA Rule

SV-214315r505936_rule

Vulnerability Number

V-214315

Group Title

SRG-APP-000120-WSR-000070

Rule Version

AS24-W1-000200

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Obtain the log location by reviewing the <'INSTALL PATH'>\conf\httpd.conf file.

Click the "Browse" button and navigate to the directory where the log files are stored.

Right-click the log file name to review and click "Properties".

Click the "Security" tab.

Set the log file permissions for the appropriate group(s).

Click "OK".

Select "Apply" in the "Actions" pane.

Check Contents

Query the System Administrator (SA) to determine who has update access to the web server log files.

The role of auditor and the role of SA should be distinctly separate. An individual functioning as an auditor should not also serve as an SA due to a conflict of interest.

Only management-authorized individuals with a privileged ID or group ID associated with an auditor role will have access permission to log files that are greater than read on web servers he or she has been authorized to audit.

Only management-authorized individuals with a privileged ID or group ID associated with either an SA or Web Administrator role may have read authority to log files for the web servers he or she has been authorized to administer.

If an account with roles other than auditor has greater than read authority to the log files, this is a finding.

Obtain the log location by reviewing the <'INSTALL PATH'>\conf\httpd.conf file.

Click the "Browse" button and navigate to the directory where the log files are stored.

Right-click the log file name to review and click "Properties".

Click the "Security" tab.

If an account associated with roles other than auditors, SAs, or Web Administrators has any access to log files, this is a finding.

If an account with roles other than auditor has greater than read authority to the log files, this is a finding.

This check does not apply to service account IDs used by automated services necessary to process, manage, and store log files.

Vulnerability Number

V-214315

Documentable

False

Rule Version

AS24-W1-000200

Severity Override Guidance

Query the System Administrator (SA) to determine who has update access to the web server log files.

The role of auditor and the role of SA should be distinctly separate. An individual functioning as an auditor should not also serve as an SA due to a conflict of interest.

Only management-authorized individuals with a privileged ID or group ID associated with an auditor role will have access permission to log files that are greater than read on web servers he or she has been authorized to audit.

Only management-authorized individuals with a privileged ID or group ID associated with either an SA or Web Administrator role may have read authority to log files for the web servers he or she has been authorized to administer.

If an account with roles other than auditor has greater than read authority to the log files, this is a finding.

Obtain the log location by reviewing the <'INSTALL PATH'>\conf\httpd.conf file.

Click the "Browse" button and navigate to the directory where the log files are stored.

Right-click the log file name to review and click "Properties".

Click the "Security" tab.

If an account associated with roles other than auditors, SAs, or Web Administrators has any access to log files, this is a finding.

If an account with roles other than auditor has greater than read authority to the log files, this is a finding.

This check does not apply to service account IDs used by automated services necessary to process, manage, and store log files.

Check Content Reference

M

Target Key

3998

Comments