<Group id="http">
<title>Web Server</title>
<description>The web server is responsible for providing access to
content via the HTTP protocol. Web servers represent a significant
security risk because:
<br /><br />
<ul>
<li>The HTTP port is commonly probed by malicious sources</li>
<li>Web server software is very complex, and includes a long
history of vulnerabilities</li>
<li>The HTTP protocol is unencrypted and vulnerable to passive
monitoring</li>
</ul>
<br /><br />
The system's default web server software is Apache 2 and is
provided in the RPM package <tt>httpd</tt>.</description>

<Group id="disabling_httpd">
<title>Disable Apache if Possible</title>
<description>If Apache was installed and activated, but the system
does not need to act as a web server, then it should be disabled
and removed from the system.
</description>

<Rule id="disable_httpd">
<title>Disable httpd Service</title>
<description>
<service-disable-macro service="httpd" />
</description>
<ocil>
<service-disable-check-macro service="httpd" />
</ocil>
<rationale>
Running web server software provides a network-based avenue
of attack, and should be disabled if not needed.
</rationale>
<ident cce="27075-1" />
<oval id="service_httpd_disabled" />
<ref nist="CM-7" />
</Rule>

<Rule id="package_httpd_removed">
<title>Uninstall httpd Package</title>
<description>
<package-remove-macro package="httpd" />
</description>
<ocil>
<package-check-macro package="httpd" />
</ocil>
<rationale>
If there is no need to make the web server software available,
removing it provides a safeguard against its activation.
</rationale>
<ident cce="27133-8" />
<oval id="package_httpd_removed" />
<ref nist="CM-7" />
</Rule>

</Group> <!--<Group id="disabling_httpd"> -->

<Group id="installing_httpd">
<title>Install Apache if Necessary</title>
<description>If <tt>httpd</tt> was not installed and activated, but the system
needs to act as a web server, then it should be installed on the system. Follow these
guidelines to install it defensively. The <tt>httpd</tt> package can be installed with
the following command:
<pre>$ sudo yum install httpd</pre>
This method of installation is recommended over installing the "Web Server"
package group during the system installation process. The Web Server package
group includes many packages which are likely extraneous, while the
command-line method installs only the required <tt>httpd</tt> package itself.
</description>

<Group id="httpd_minimal_modules_installed">
<title>Confirm Minimal Built-in Modules Installed</title>
<description>The default <tt>httpd</tt> installation minimizes the number of
modules that are compiled directly into the binary (<tt>core prefork http_core
mod_so</tt>). This minimizes risk by limiting the capabilities allowed by the
web server.

Query the set of compiled-in modules using the following command:
<pre>$ httpd -l</pre>
If the number of compiled-in modules is significantly larger than the
aforementioned set, this guide recommends re-installing <tt>httpd</tt> with a
reduced configuration. Minimizing the number of modules that are compiled into
the <tt>httpd</tt> binary, reduces risk by limiting the capabilities allowed by
the webserver.
</description>

</Group> <!-- <Group id="httpd_minimal_modules_installed"> -->

</Group> <!-- <Group id="installing_httpd"> -->

<Group id="securing_httpd">
<title>Secure Apache Configuration</title>
<description>The <tt>httpd</tt> configuration file is
<tt>/etc/httpd/conf/httpd.conf</tt>. Apply the recommendations in the remainder
of this section to this file.</description>

<Group id="httpd_restrict_info_leakage">
<title>Restrict Web Server Information Leakage</title>
<description>
The <tt>ServerTokens</tt> and <tt>ServerSignature</tt> directives determine how
much information the web server discloses about the configuration of the
system.</description>

<Rule id="httpd_servertokens_prod">
<title>Set httpd <tt>ServerTokens</tt> Directive to <tt>Prod</tt></title>
<description>
<tt>ServerTokens Prod</tt> restricts information in page headers, returning only the word "Apache."
<br /><br />
Add or correct the following directive in <tt>/etc/httpd/conf/httpd.conf</tt>:
<pre>ServerTokens Prod</pre>
</description>
<rationale>
Information disclosed to clients about the configuration of the web server and system could be used
to plan an attack on the given system. This information disclosure should be restricted to a minimum.
</rationale>
<ref nist="CM-7" />
<ident cce="27425-8" />
</Rule>

<Rule id="httpd_serversignature_off">
<title>Set httpd <tt>ServerSignature</tt> Directive to <tt>Off</tt></title>
<description>
<tt>ServerSignature Off</tt> restricts <tt>httpd</tt> from displaying server version number
on error pages.
<br /><br />
Add or correct the following directive in <tt>/etc/httpd/conf/httpd.conf</tt>:
<pre>ServerSignature Off</pre>
</description>
<rationale>
Information disclosed to clients about the configuration of the web server and system could be used
to plan an attack on the given system. This information disclosure should be restricted to a minimum.
</rationale>
<ident cce="27586-7" />
<ref nist="CM-7" />
</Rule>

</Group> <!-- <Group id="httpd_restrict_info_leakage"> -->

<Group id="httpd_minimize_loadable_modules">
<title>Minimize Web Server Loadable Modules</title>
<description>
A default installation of <tt>httpd</tt> includes a plethora of dynamically shared objects (DSO)
that are loaded at run-time. Unlike the aforementioned compiled-in modules, a DSO can be
disabled in the configuration file by removing the corresponding LoadModule directive.
<br /><br />
Note: A DSO only provides additional functionality if associated directives are included
in the <tt>httpd</tt> configuration file. It should also be noted that removing a DSO will produce
errors on <tt>httpd</tt> startup if the configuration file contains directives that apply to that
module. Refer to <tt>http://httpd.apache.org/docs/</tt> for details on which directives
are associated with each DSO.
<br /><br />
Following each DSO removal, the configuration can be tested with the following command
to check if everything still works:
<pre>$ sudo service httpd configtest</pre>
The purpose of each of the modules loaded by default will now be addressed one at a time.
If none of a module's directives are being used, remove it.
</description>

<Group id="httpd_core_modules">
<title><tt>httpd</tt> Core Modules</title>
<description>
These modules comprise a basic subset of modules that are likely needed for base <tt>httpd</tt>
functionality; ensure they are not commented out in <tt>/etc/httpd/conf/httpd.conf</tt>:
<pre>LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule authn_default_module modules/mod_authn_default.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_default_module modules/mod_authz_default.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule logio_module modules/mod_logio.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule mime_module modules/mod_mome.so
LoadModule autoindex_module modules/mod_autoindex.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule dir_module modules/mod_dir.so
LoadModule alias_module modules/mod_alias.so</pre>
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</description>

<Group id="httpd_basic_authentication">
<title>Minimize Modules for HTTP Basic Authentication</title>
<description>
The following modules are necessary if this web server will provide content that will
be restricted by a password.
<br /><br />
Authentication can be performed using local plain text password files (<tt>authn_file</tt>),
local DBM password files (<tt>authn_dbm</tt>) or an LDAP directory. The only module required by
the web server depends on your choice of authentication. Comment out the modules you don't
need from the following:
<pre>LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_dbm_module modules/mod_authn_dbm.so</pre>
<tt>authn_alias</tt> allows for authentication based on aliases. <tt>authn_anon</tt>
allows anonymous authentication similar to that of anonymous ftp sites. <tt>authz_owner</tt>
allows authorization based on file ownership. <tt>authz_dbm</tt> allows for authorization
based on group membership if the web server is using DBM authentication.
<br /><br />
If the above functionality is unnecessary, comment out the related module:
<pre>#LoadModule authn_alias_module modules/mod_authn_alias.so
#LoadModule authn_anon_module modules/mod_authn_anon.so
#LoadModule authz_owner_module modules/mod_authz_owner.so
#LoadModule authz_dbm_module modules/mod_authz_dbm.so</pre>
</description>
</Group>

<Rule id="httpd_digest_authentication">
<title>Disable HTTP Digest Authentication</title>
<description>
The <tt>auth_digest</tt> module provides encrypted authentication sessions.
If this functionality is unnecessary, comment out the related module:
<pre>#LoadModule auth_digest_module modules/mod_auth_digest.so</pre>
</description>
<rationale>
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
<ident cce="27553-7" />
</Rule>

<Rule id="httpd_mod_rewrite">
<title>Disable HTTP mod_rewrite</title>
<description>
The <tt>mod_rewrite</tt> module is very powerful and can protect against
certain classes of web attacks. However, it is also very complex and has a
significant history of vulnerabilities itself. If its functionality is
unnecessary, comment out the related module:
<pre>#LoadModule rewrite_module modules/mod_rewrite.so</pre>
</description>
<rationale>
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
<ident cce="27570-1" />
</Rule>

<Rule id="httpd_ldap_support">
<title>Disable LDAP Support</title>
<description>
The <tt>ldap</tt> module provides HTTP authentication via an LDAP directory.
If its functionality is unnecessary, comment out the related modules:
<pre>#LoadModule ldap_module modules/mod_ldap.so
#LoadModule authnz_ldap_module modules/mod_authnz_ldap.so</pre>
If LDAP is to be used, SSL encryption should be used as well.
</description>
<rationale>
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
<ident cce="27395-3" />
</Rule>

<Rule id="httpd_server_side_includes">
<title>Disable Server Side Includes</title>
<description>
Server Side Includes provide a method of dynamically generating web pages through the
insertion of server-side code. However, the technology is also deprecated and
introduces significant security concerns.
If this functionality is unnecessary, comment out the related module:
<pre>#LoadModule include_module modules/mod_include.so</pre>
If there is a critical need for Server Side Includes, they should be enabled with the
option <tt>IncludesNoExec</tt> to prevent arbitrary code execution. Additionally, user
supplied data should be encoded to prevent cross-site scripting vulnerabilities.
</description>
<rationale>
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
<ident cce="27558-6" />
</Rule>

<Rule id="httpd_mime_magic">
<title>Disable MIME Magic</title>
<description>
The <tt>mime_magic</tt> module provides a second layer of MIME support that in most configurations
is likely extraneous. If its functionality is unnecessary, comment out the related module:
<pre>#LoadModule mime_magic_module modules/mod_mime_magic.so</pre>
</description>
<rationale>
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
<ident cce="27541-2" />
</Rule>

<Rule id="httpd_webdav">
<title>Disable WebDAV (Distributed Authoring and Versioning)</title>
<description>
WebDAV is an extension of the HTTP protocol that provides distributed and
collaborative access to web content. If its functionality is unnecessary,
comment out the related modules:
<pre>#LoadModule dav_module modules/mod_dav.so
#LoadModule dav_fs_module modules/mod_dav_fs.so</pre>
If there is a critical need for WebDAV, extra care should be taken in its configuration.
Since DAV access allows remote clients to manipulate server files, any location on the
server that is DAV enabled should be protected by access controls.
</description>
<rationale>
Minimizing the number of loadable modules available to the web server, reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
<ident cce="27329-2" />
</Rule>

<Rule id="httpd_server_activity_status">
<title>Disable Server Activity Status</title>
<description>
The <tt>status</tt> module provides real-time access to statistics on the internal operation of
the web server. This may constitute an unnecessary information leak and should be disabled
unless necessary. To do so, comment out the related module:
<pre>#LoadModule status_module modules/mod_status.so</pre>
If there is a critical need for this module, ensure that access to the status
page is properly restricted to a limited set of hosts in the status handler
configuration.
</description>
<rationale>
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
<ident cce="27468-8" />
</Rule>

<Rule id="httpd_server_configuration_display">
<title>Disable Web Server Configuration Display</title>
<description>
The <tt>info</tt> module creates a web page illustrating the configuration of the web server. This
can create an unnecessary security leak and should be disabled.
If its functionality is unnecessary, comment out the module:
<pre>#LoadModule info_module modules/mod_info.so</pre>
If there is a critical need for this module, use the <tt>Location</tt> directive to provide
an access control list to restrict access to the information.
</description>
<rationale>
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
<ident cce="27507-3" />
</Rule>

<Rule id="httpd_url_correction">
<title>Disable URL Correction on Misspelled Entries</title>
<description>
The <tt>speling</tt> module attempts to find a document match by allowing one misspelling in an
otherwise failed request. If this functionality is unnecessary, comment out the module:
<pre>#LoadModule speling_module modules/mod_speling.so</pre>
This functionality weakens server security by making site enumeration easier.
</description>
<rationale>
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
<ident cce="27276-5" />
</Rule>

<Rule id="httpd_proxy_support">
<title>Disable Proxy Support</title>
<description>
The <tt>proxy</tt> module provides proxying support, allowing <tt>httpd</tt> to forward requests and
serve as a gateway for other servers. If its functionality is unnecessary, comment out the module:
<pre>#LoadModule proxy_module modules/mod_proxy.so</pre>
<!-- dependencies: #LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
#LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
#LoadModule proxy_http_module modules/mod_proxy_http.so
#LoadModule proxy_connect_module modules/mod_proxy_connect.so-->
If proxy support is needed, load <tt>mod_proxy</tt> and the appropriate proxy protocol handler
module (one of <tt>mod_proxy_http</tt>, <tt>mod_proxy_ftp</tt>, or <tt>mod_proxy_connect</tt>). Additionally,
make certain that a server is secure before enabling proxying, as open proxy servers
are a security risk. <tt>mod_proxy_balancer</tt> enables load balancing, but requires that
<tt>mod status</tt> be enabled.
</description>
<rationale>
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
<ident cce="27442-3" />
</Rule>

<Rule id="httpd_cache_support">
<title>Disable Cache Support</title>
<description>
The <tt>cache</tt> module allows <tt>httpd</tt> to cache data, optimizing access to
frequently accessed content. However, it introduces potential security flaws
such as the possibility of circumventing <tt>Allow</tt> and
<tt>Deny</tt> directives.
<br /><br /> If this functionality is
unnecessary, comment out the module:
<pre>#LoadModule cache_module modules/mod_cache.so</pre>
If caching is required, it should not be enabled for any limited-access content.
</description>
<rationale>
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
<ident cce="26859-9" />
</Rule>

<Rule id="httpd_cgi_support">
<title>Disable CGI Support</title>
<description>
The <tt>cgi</tt> module allows HTML to interact with the CGI web programming language.
<br /><br />
If this functionality is unnecessary, comment out the module:
<pre>#LoadModule cgi_module modules/mod_cgi.so</pre>
<!--#LoadModule env_module modules/mod_env.so
#LoadModule actions_module modules/mod_actions.so
#LoadModule suexec_module modules/mod_suexec.so -->
If the web server requires the use of CGI, enable <tt>mod_cgi</tt>.
<!-- If extended
CGI functionality is required, include the appropriate modules. <tt>env</tt> allows for
control of the environment passed to CGI scripts. <tt>actions</tt> allows CGI events
to be triggered when files of a certain type are requested. <tt>su exec</tt> allows
CGI scripts to run as a specified user/group instead of as the server's user/group. -->
</description>
<rationale>
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
<ident cce="27362-3" />
</Rule>

<Group id="httpd_optional_components">
<title>Minimize Various Optional Components</title>
<description>
The following modules perform very specific tasks, sometimes providing access to
just a few additional directives. If such functionality is not required (or if you
are not using these directives), comment out the associated module:
<ul>
<li>External filtering (response passed through external program prior to client delivery)
<pre>#LoadModule ext_filter_module modules/mod_ext_filter.so</pre></li>
<li>User-specified Cache Control and Expiration
<pre>#LoadModule expires_module modules/mod_expires.so</pre></li>
<li>Compression Output Filter (provides content compression prior to client delivery)
<pre>#LoadModule deflate_module modules/mod_deflate.so</pre></li>
<li>HTTP Response/Request Header Customization
<pre>#LoadModule headers_module modules/mod_headers.so</pre></li>
<li>User activity monitoring via cookies
<pre>#LoadModule usertrack_module modules/mod_usertrack.so</pre></li>
<li>Dynamically configured mass virtual hosting
<pre>#LoadModule vhost_alias_module modules/mod_vhost_alias.so</pre></li>
</ul>
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.
</description>
</Group>

<Group id="httpd_minimize_config_files_included">
<title>Minimize Configuration Files Included</title>
<description>
The <tt>Include</tt> directive directs <tt>httpd</tt> to load supplementary configuration files
from a provided path. The default configuration loads all files that end in <tt>.conf</tt>
from the <tt>/etc/httpd/conf.d</tt> directory.
<br /><br />
To restrict excess configuration, the following line should be commented out and
replaced with <tt>Include</tt> directives that only reference required configuration files:
<pre>#Include conf.d/*.conf</pre>
If the above change was made, ensure that the SSL encryption remains loaded by
explicitly including the corresponding configuration file:
<pre>Include conf.d/ssl.conf</pre>
If PHP is necessary, a similar alteration must be made:
<pre>Include conf.d/php.conf</pre>
<!--<rationale>-->
Explicitly listing the configuration files to be loaded during web server start-up avoids
the possibility of unwanted or malicious configuration files to be automatically included as
part of the server's running configuration.
<!--</rationale>-->
</description>
</Group>

</Group> <!-- <Group id="httpd_core_modules"> -->

</Group> <!-- <Group id="httpd_minimize_loadable_modules"> -->

<Group id="httpd_directory_restrictions">
<title>Directory Restrictions</title>
<description>
The Directory tags in the web server configuration file allow finer grained access
control for a specified directory. All web directories should be configured on a
case-by-case basis, allowing access only where needed.
</description>

<Rule id="httpd_restrict_root_directory">
<title>Restrict Root Directory</title>
<description>
The <tt>httpd</tt> root directory should always have the most restrictive configuration enabled.
<pre>&lt;Directory / &gt;
   Options None
   AllowOverride None
   Order allow,deny
&lt;/Directory&gt;</pre>
</description>
<rationale>
The Web Server's root directory content should be protected from unauthorized access
by web clients.
</rationale>
<ident cce="27009-0" />
</Rule>

<Rule id="httpd_restrict_web_directory">
<title>Restrict Web Directory</title>
<description>
The default configuration for the web (<tt>/var/www/html</tt>) Directory allows directory
indexing (<tt>Indexes</tt>) and the following of symbolic links (<tt>FollowSymLinks</tt>).
Neither of these is recommended.
<br /><br />
The <tt>/var/www/html</tt> directory hierarchy should not be viewable via the web, and
symlinks should only be followed if the owner of the symlink also owns the linked file.
<br /><br />
Ensure that this policy is adhered to by altering the related section of the configuration:
<pre>&lt;Directory "/var/www/html"&gt;
#  ...
   Options SymLinksIfOwnerMatch
#  ...
&lt;/Directory&gt;</pre>
</description>
<rationale>
Access to the web server's directory hierarchy could allow access to unauthorized files
by web clients. Following symbolic links could also allow such access.
</rationale>
<ident cce="27574-3" />
</Rule>

<Rule id="httpd_restrict_critical_directories">
<title>Restrict Other Critical Directories</title>
<description>
All accessible web directories should be configured with similarly restrictive settings.
The <tt>Options</tt> directive should be limited to necessary functionality and the <tt>AllowOverride</tt>
directive should be used only if needed. The <tt>Order</tt> and <tt>Deny</tt> access control tags
should be used to deny access by default, allowing access only where necessary.
</description>
<rationale>
Directories accessible from a web client should be configured with the least amount of
access possible in order to avoid unauthorized access to restricted content or server information.
</rationale>
<ident cce="27565-1" />
</Rule>

<Rule id="httpd_limit_available_methods">
<title>Limit Available Methods</title>
<description>
Web server methods are defined in section 9 of RFC 2616 (http://www.ietf.org/rfc/rfc2616.txt).
If a web server does not require the implementation of all available methods,
they should be disabled.
<br /><br />
Note: <tt>GET</tt> and <tt>POST</tt> are the most common methods. A majority of the others
are limited to the WebDAV protocol.
<pre>&lt;Directory /var/www/html&gt;
# ...
   # Only allow specific methods (this command is case-sensitive!)
   &lt;LimitExcept GET POST&gt;
      Order allow,deny
   &lt;/LimitExcept&gt;
# ...
&lt;/Directory&gt;</pre>
</description>
<rationale>
Minimizing the number of available methods to the web client reduces risk
by limiting the capabilities allowed by the web server.
</rationale>
<ident cce="27581-8" />
</Rule>

</Group> <!-- <Group id="httpd_directory_restrictions"> -->

<Group id="httpd_modules_improve_security">
<title>Use Appropriate Modules to Improve <tt>httpd</tt>'s Security</title>
<description>
Among the modules available for <tt>httpd</tt> are several whose use may improve the
security of the web server installation. This section recommends and discusses
the deployment of security-relevant modules.
</description>

<Group id="httpd_deploy_mod_ssl">
<title>Deploy <tt>mod_ssl</tt></title>
<description>
Because HTTP is a plain text protocol, all traffic is susceptible to passive
monitoring. If there is a need for confidentiality, SSL should be configured
and enabled to encrypt content.
<br /><br />
Note: <tt>mod_nss</tt> is a FIPS 140-2 certified alternative to <tt>mod_ssl</tt>.
The modules share a considerable amount of code and should be nearly identical
in functionality. If FIPS 140-2 validation is required, then <tt>mod_nss</tt> should
be used. If it provides some feature or its greater compatibility is required,
then <tt>mod_ssl</tt> should be used.
</description>

<Rule id="httpd_install_mod_ssl">
<title>Install <tt>mod_ssl</tt></title>
<description>
Install the <tt>mod_ssl</tt> module:
<pre>$ sudo yum install mod_ssl</pre>
</description>
<rationale>
<tt>mod_ssl</tt> provides encryption capabilities for the <tt>httpd</tt> Web server. Unencrypted
content is transmitted in plain text which could be passively monitored and accessed by
unauthorized parties.
</rationale>
<ident cce="27403-5" />
</Rule>

</Group> <!-- <Group id="httpd_deploy_mod_ssl"> -->

<Group id="httpd_deploy_mod_security">
<title>Deploy <tt>mod_security</tt></title>
<description>
The <tt>security</tt> module provides an application level firewall for <tt>httpd</tt>.
Following its installation with the base ruleset, specific configuration advice can be found at
http://www.modsecurity.org/ to design a policy that best matches the security needs of
the web applications. Usage of <tt>mod_security</tt> is highly recommended for some environments,
but it should be noted this module does not ship with Red Hat Enterprise Linux itself,
and instead is provided via Extra Packages for Enterprise Linux (EPEL).
For more information on EPEL please refer to http://fedoraproject.org/wiki/EPEL.
</description>

<Rule id="httpd_install_mod_security">
<title>Install <tt>mod_security</tt></title>
<description>
Install the <tt>security</tt> module:
<pre>$ sudo yum install mod_security</pre>
<!-- this is in EPEL and this rule should not be included in any RHEL-only baselines -->
</description>
<rationale>
<tt>mod_security</tt> provides an additional level of protection for the web server by
enabling the administrator to implement content access policies and filters at the
application layer.
</rationale>
<ident cce="27525-5" />
</Rule>

</Group> <!-- <Group id="httpd_deploy_mod_security"> -->

</Group> <!-- <Group id="httpd_modules_improve_security"> -->

<Group id="httpd_use_dos_protection_modules">
<title>Use Denial-of-Service Protection Modules</title>
<description>
Denial-of-service attacks are difficult to detect and prevent while maintaining
acceptable access to authorized users. However, some traffic-shaping
modules can be used to address the problem. Well-known DoS protection modules include:
<pre>mod_cband mod_bwshare mod_limitipconn mod_evasive</pre>
Denial-of-service prevention should be implemented for a web server if such a threat exists.
However, specific configuration details are very dependent on the environment and often best left
at the discretion of the administrator.
</description>
</Group> <!-- <Group id="httpd_use_dos_protection_modules"> -->

<Group id="httpd_configure_php_securely">
<title>Configure PHP Securely</title>
<description>
PHP is a widely-used and often misconfigured server-side scripting language. It should
be used with caution, but configured appropriately when needed.
<br /><br />
Review <tt>/etc/php.ini</tt> and make the following changes if possible:
<pre># Do not expose PHP error messages to external users
display_errors = Off

# Enable safe mode
safe_mode = On

# Only allow access to executables in isolated directory
safe_mode_exec_dir = php-required-executables-path

# Limit external access to PHP environment
safe_mode_allowed_env_vars = PHP_

# Restrict PHP information leakage
expose_php = Off

# Log all errors
log_errors = On

# Do not register globals for input data
register_globals = Off

# Minimize allowable PHP post size
post_max_size = 1K

# Ensure PHP redirects appropriately
cgi.force_redirect = 0

# Disallow uploading unless necessary
file_uploads = Off

# Disallow treatment of file requests as fopen calls
allow_url_fopen = Off

# Enable SQL safe mode
sql.safe_mode = On
</pre>
</description>

</Group> <!-- <Group id="httpd_configure_php_securely"> -->

<Group id="httpd_configure_os_protect_web_server">
<title>Configure Operating System to Protect Web Server</title>
<description>
The following configuration steps should be taken on the machine which hosts the
web server, in order to provide as safe an environment as possible for the web server.
</description>

<Group id="httpd_restrict_file_dir_access">
<title>Restrict File and Directory Access</title>
<description>
Minimize access to critical <tt>httpd</tt> files and directories.
</description>

<Rule id="httpd_logs_permissions">
<title>Set Permissions on the <tt>/var/log/httpd/</tt> Directory</title>
<description>
Ensure that the permissions on the web server log directory is set to 700:
<pre>$ sudo chmod 700 /var/log/httpd/</pre>
This is its default setting.
</description>
<rationale>
Access to the web server's log files may allow an unauthorized user or attacker
to access information about the web server or alter the server's log files.
</rationale>
<ident cce="27150-2" />
<oval id="dir_perms_var_log_httpd" />
<ref nist="CM-7" />
</Rule>

<Rule id="httpd_conf_dir_permissions">
<title>Set Permissions on the <tt>/etc/httpd/conf/</tt> Directory</title>
<description>
Set permissions on the web server configuration directory to 750:
<pre>$ sudo chmod 750 /etc/httpd/conf/</pre>
</description>
<rationale>
Access to the web server's configuration files may allow an unauthorized user or attacker
to access information about the web server or alter the server's configuration files.
</rationale>
<oval id="dir_perms_etc_httpd_conf" />
<ident cce="27487-8" />
</Rule>

<Rule id="httpd_conf_files_permissions">
<title>Set Permissions on All Configuration Files Inside <tt>/etc/httpd/conf/</tt></title>
<description>
Set permissions on the web server configuration files to 640:
<pre>$ sudo chmod 640 /etc/httpd/conf/*</pre>
</description>
<rationale>
Access to the web server's configuration files may allow an unauthorized user or attacker
to access information about the web server or to alter the server's configuration files.
</rationale>
<oval id="file_permissions_httpd_server_conf_files" />
<ref nist="CM-7" />
<ident cce="27316-9" />
</Rule>

</Group> <!-- <Group id="httpd_restrict_file_dir_access"> -->

<Group id="httpd_configure_iptables">
<title>Configure <tt>iptables</tt> to Allow Access to the Web Server</title>
<description>
By default, <tt>iptables</tt>
blocks access to the ports used by the web server.
<iptables-desc-macro allow="true" proto="tcp" port="80" />
<iptables-desc-macro allow="true" proto="tcp" port="443" />
</description>

</Group> <!-- <Group id="httpd_configure_iptables"> -->

<Group id="httpd_chroot">
<title>Run <tt>httpd</tt> in a <tt>chroot</tt> Jail if Practical</title>
<description>
Running <tt>httpd</tt> inside a <tt>chroot</tt> jail is designed to isolate the
web server process to a small section of the filesystem, limiting the damage if
it is compromised. Versions of Apache greater than 2.2.10 (such as the one
included with Red Hat Enterprise Linux 6) provide the <tt>ChrootDir</tt> directive. To run Apache
inside a chroot jail in <tt>/chroot/apache</tt>, add the following line to
<tt>/etc/httpd/conf/httpd.conf</tt>: <pre>ChrootDir /chroot/apache</pre> This
necessitates placing all files required by <tt>httpd</tt> inside
<tt>/chroot/apache</tt> , including <tt>httpd</tt>'s binaries, modules,
configuration files, and served web pages. The details of this configuration
are beyond the scope of this guide. This may also require additional SELinux
configuration.
</description>

</Group> <!-- <Group id="httpd_chroot"> -->

</Group> <!-- <Group id="httpd_configure_os_protect_web_server"> -->

</Group> <!-- <Group id="securing_httpd"> -->

</Group> <!-- <Group id="http"> -->
