← Back to Oracle HTTP Server 12.1.3 Security Technical Implementation Guide

V-221436

CAT III (Low)

OHS must have the HostnameLookups directive enabled.

Rule ID

SV-221436r961863_rule

STIG

Oracle HTTP Server 12.1.3 Security Technical Implementation Guide

Version

V2R3

CCIs

CCI-000366

Discussion

Setting the "HostnameLookups" to "On" allows for more information to be logged in the event of an attack and subsequent investigation. This information can be added to other information gathered to narrow the attacker location. The DNS name can also be used for filtering access to the OHS hosted applications by denying particular types of hostnames.

Check Content

1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/httpd.conf and every .conf file (e.g., ssl.conf) included in it with an editor.

2. Search for the "HostnameLookups" directive at the server, virtual host, and directory configuration scopes.

3. If the "HostnameLookups" directive is omitted or is not set to "On", this is a finding.

Fix Text

1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/httpd.conf and every .conf file (e.g., ssl.conf) included in it with an editor.

2. Search for the "HostnameLookups" directive at the server, virtual host, and directory configuration scopes.

3. Set the "HostnameLookups" directive to "On", add the directive if it does not exist.