STIGQter: STIG Summary: APACHE 2.2 Site for UNIX Security Technical Implementation Guide Version: 1 Release: 11 Benchmark Date: 25 Jan 2019:

Access to the web server log files must be restricted to administrators, web administrators, and auditors.

DISA Rule

SV-36643r1_rule

Vulnerability Number

V-13689

Group Title

WG255

Rule Version

WG255 A22

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

To ensure the integrity of the data that is being captured in the log files, ensure that only the members of the Auditors group, Administrators, and the user assigned to run the web server software is granted permissions to read the log files.

Check Contents

Look for the presence of log files at:

/usr/local/apache/logs/access_log

To ensure the correct location of the log files, examine the "ServerRoot" directive in the htttpd.conf file and then navigate to that directory where you will find a subdirectory for the logs.

Determine permissions for log files, from the command line: cd to the directory where the log files are located and enter the command:

ls –al *log and note the owner and group permissions on these files. Only the Auditors, Web Managers, Administrators, and the account that runs the web server should have permissions to the files.

If any users other than those authorized have read access to the log files, this is a finding.

Vulnerability Number

V-13689

Documentable

False

Rule Version

WG255 A22

Severity Override Guidance

Look for the presence of log files at:

/usr/local/apache/logs/access_log

To ensure the correct location of the log files, examine the "ServerRoot" directive in the htttpd.conf file and then navigate to that directory where you will find a subdirectory for the logs.

Determine permissions for log files, from the command line: cd to the directory where the log files are located and enter the command:

ls –al *log and note the owner and group permissions on these files. Only the Auditors, Web Managers, Administrators, and the account that runs the web server should have permissions to the files.

If any users other than those authorized have read access to the log files, this is a finding.

Check Content Reference

M

Responsibility

Web Administrator

Target Key

161

Comments