← Back to Apache Server 2.4 UNIX Server Security Technical Implementation Guide

V-214241

CAT II (Medium)

The Apache web server must not be a proxy server.

Rule ID

SV-214241r1051280_rule

STIG

Apache Server 2.4 UNIX Server Security Technical Implementation Guide

Version

V3R2

CCIs

CCI-000381

Discussion

A web server should be primarily a web server or a proxy server but not both, for the same reasons that other multiuse servers are not recommended. Scanning for web servers that will also proxy requests into an otherwise protected network is a very common attack, making the attack anonymous.

Check Content

If the server has been approved to be a proxy server, this requirement is Not Applicable.

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file:

# apachectl -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"
-D SERVER_CONFIG_FILE="conf/httpd.conf"

Note: The apachectl front end is the preferred method for locating the Apache httpd file. For some Linux distributions, "apache2ctl -V" or "httpd -V" can also be used. 

Search for the directive "ProxyRequests" in the "httpd.conf" file. 

If the ProxyRequests directive is set to "On", this is a finding.

Fix Text

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file:

# apachectl -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"
-D SERVER_CONFIG_FILE="conf/httpd.conf"

Edit the file and comment out the ProxyRequests directive in the httpd.conf file.

Restart Apache: apachectl restart