STIGQter: STIG Summary: Apache Server 2.4 Windows Server Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The Apache web server must restrict inbound connections from nonsecure zones.

DISA Rule

SV-214343r505936_rule

Vulnerability Number

V-214343

Group Title

SRG-APP-000315-WSR-000004

Rule Version

AS24-W1-000670

Severity

CAT II

CCI(s)

• CCI-002314 - The information system controls remote access methods.

Weight

10

Fix Recommendation

Configure the "http.conf" file to include restrictions.

Example:

<RequireAll>
Require not host phishers.example.com moreidiots.example
</RequireAll>

Restart the Apache service.

Check Contents

Review the <'INSTALL PATH'>\conf\httpd.conf file.

If "IP Address Restrictions" are not configured or IP ranges configured to be "Allow" are not restrictive enough to prevent connections from nonsecure zones, this is a finding.

Vulnerability Number

V-214343

Documentable

False

Rule Version

AS24-W1-000670

Severity Override Guidance

Review the <'INSTALL PATH'>\conf\httpd.conf file.

If "IP Address Restrictions" are not configured or IP ranges configured to be "Allow" are not restrictive enough to prevent connections from nonsecure zones, this is a finding.

Check Content Reference

M

Target Key

3998

Comments