← Back to Oracle HTTP Server 12.1.3 Security Technical Implementation Guide

V-221470

CAT III (Low)

OHS hosted web sites must utilize ports, protocols, and services according to PPSM guidelines.

Rule ID

SV-221470r961863_rule

STIG

Oracle HTTP Server 12.1.3 Security Technical Implementation Guide

Version

V2R3

CCIs

CCI-000366

Discussion

Failure to comply with DoD ports, protocols, and services (PPS) requirements can result in compromise of enclave boundary protections and/or functionality of the automated information system (AIS). The ISSM will ensure web servers are configured to use only authorized PPS in accordance with the Network Infrastructure STIG, DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM), and the associated Ports, Protocols, and Services (PPS) Assurance Category Assignments List.

Check Content

1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/httpd.conf and every .conf file (e.g., ssl.conf) included in it with an editor.

2. Search for the "Listen" directive at the OHS server configuration scope.

3. If the "Listen" directive port specified is not "80" or "443", this is a finding.

Fix Text

1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/httpd.conf and every .conf file (e.g., ssl.conf) included in it with an editor.

2. Search for the "Listen" directive at the OHS server configuration scope.

3. Set the "Listen" directive to "80" for http ports and "443" for https ports.