APACHE 2.2 Site for Windows Security Technical Implementation Guide

Version

V1R13

Benchmark ID

APACHE_SITE_2.2_WINDOWS

Total Checks

Tags

windowsweb

CAT I: 3CAT II: 21CAT III: 4

All directives specified in this STIG must be specifically set (i.e. the server is not allowed to revert to programmed defaults for these directives). Included files should be reviewed if they are used. Procedures for reviewing included files are included in the overview document. The use of .htaccess files are not authorized for use according to the STIG. However, if they are used, there are procedures for reviewing them in the overview document. The Web Policy STIG should be used in addition to the Apache Site and Server STIGs in order to do a comprehensive web server review.

Export CKL Export CSV Export JSON

Checks (28)

V-13686HIGHWeb Administrators must only use encrypted connections for Document Root directory uploads.V-13688MEDIUMLog file data must contain required data elements.V-13689MEDIUMAccess to the web server log files must be restricted to Administrators, the user assigned to run the web server software, Web Manager, and Auditors.V-13694MEDIUMPublic web servers must use TLS if authentication is required.V-15334LOWWeb sites must utilize ports, protocols, and services according to PPSM guidelines.V-2226MEDIUMWeb content directories must not be anonymously shared.V-2228MEDIUMAll interactive programs must be placed in a designated directory with appropriate permissions.V-2229MEDIUMInteractive scripts used on a web server must have proper access controls.V-2240MEDIUMThe number of allowed simultaneous requests must be set.V-2245LOWEach readable web document directory must contain either a default, home, index, or equivalent file.V-2249HIGHWeb server administration must be performed over a secure path or at the local console.V-2250MEDIUMLogs of web server access and errors must be established and maintained.V-2252MEDIUMLog file access must be restricted to System Administrators, Web Administrators or Auditors.V-2254MEDIUMOnly web sites that have been fully reviewed and tested must exist on a production web server.V-2258HIGHThe web client account access to the content and scripts directories must be limited to read and execute.V-2260MEDIUMA web site must not contain a robots.txt file.V-2262MEDIUMA private web server must utilize an approved TLS version.V-2263MEDIUMA private web server must have a valid DoD server certificate.V-2265LOWJava software on production web servers must be limited to class files and the JAVA virtual machine.V-2270MEDIUMAnonymous FTP user access to interactive scripts must be prohibited.V-2272MEDIUMPERL scripts must use the TAINT option.V-26279MEDIUMError logging must be enabled.V-26280MEDIUMThe sites error logs must log the correct format.V-26281MEDIUMSystem logging must be enabled.V-26282MEDIUMThe LogLevel directive must be enabled.V-3333MEDIUMThe web document (home) directory must be in a separate partition from the web server’s system files.V-6373LOWThe required DoD banner page must be displayed to authenticated users accessing a DoD private website.V-6531MEDIUMPrivate web servers must require certificates issued from a DoD-authorized Certificate Authority.