STIGhubSTIGhub
STIGsRMF ControlsCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • RMF Controls
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 4 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

Oracle HTTP Server 12.1.3 Security Technical Implementation Guide

Version

V2R3

Release Date

Feb 6, 2025

SCAP Benchmark ID

Oracle_HTTP_Server_12-1-3_STIG

Total Checks

280

Tags

other
CAT I: 22CAT II: 226CAT III: 32

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (280)

V-221272MEDIUMOHS must have the mpm property set to use the worker Multi-Processing Module (MPM) as the preferred means to limit the number of allowed simultaneous requests.V-221273MEDIUMOHS must have the mpm_prefork_module directive disabled so as not conflict with the worker directive used to limit the number of allowed simultaneous requests.V-221274MEDIUMOHS must have the MaxClients directive defined to limit the number of allowed simultaneous requests.V-221275MEDIUMOHS must limit the number of threads within a worker process to limit the number of allowed simultaneous requests.V-221276MEDIUMOHS must limit the number of worker processes to limit the number of allowed simultaneous requests.V-221277HIGHOHS must have the LoadModule ossl_module directive enabled to encrypt remote connections in accordance with the categorization of data hosted by the web server.V-221278HIGHOHS must have the SSLFIPS directive enabled to encrypt remote connections in accordance with the categorization of data hosted by the web server.V-221279MEDIUMOHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to encrypt remote connections in accordance with the categorization of data hosted by the web server.V-221280HIGHOHS must have the SSLCipherSuite directive enabled to encrypt remote connections in accordance with the categorization of data hosted by the web server.V-221281HIGHOHS must have the LoadModule ossl_module directive enabled to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server.V-221282HIGHOHS must have the SSLFIPS directive enabled to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server.V-221283HIGHOHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server.V-221284HIGHOHS must have the SSLCipherSuite directive enabled to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server.V-221285MEDIUMOHS must have the SecureProxy directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.V-221286MEDIUMOHS must have the WLSSLWallet directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.V-221287MEDIUMOHS must have the WebLogicSSLVersion directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.V-221288MEDIUMOHS must have the WLProxySSL directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.V-221289MEDIUMOHS must have the LoadModule log_config_module directive enabled to generate information to be used by external applications or entities to monitor and control remote access.V-221290MEDIUMOHS must have the OraLogMode set to Oracle Diagnostic Logging text mode to generate information to be used by external applications or entities to monitor and control remote access.V-221291MEDIUMOHS must have a log directory location defined to generate information for use by external applications or entities to monitor and control remote access.V-221292MEDIUMOHS must have the OraLogSeverity directive defined to generate adequate information to be used by external applications or entities to monitor and control remote access.V-221293MEDIUMOHS must have the log rotation parameter set to allow generated information to be used by external applications or entities to monitor and control remote access.V-221294MEDIUMOHS must have a log format defined to generate adequate information to be used by external applications or entities to monitor and control remote access.V-221295MEDIUMOHS must have a SSL log format defined to allow generated information to be used by external applications or entities to monitor and control remote access in accordance with the categorization of data hosted by the web server.V-221296MEDIUMOHS must have a log file defined for each site/virtual host to capture information to be used by external applications or entities to monitor and control remote access.V-221297MEDIUMRemote access to OHS must follow access policy or work in conjunction with enterprise tools designed to enforce policy requirements.V-221298MEDIUMOHS must have the Order, Allow, and Deny directives set within the Directory directives set to restrict inbound connections from nonsecure zones.V-221299MEDIUMOHS must have the Order, Allow, and Deny directives set within the Files directives set to restrict inbound connections from nonsecure zones.V-221300MEDIUMOHS must have the Order, Allow, and Deny directives set within the Location directives set to restrict inbound connections from nonsecure zones.V-221301MEDIUMOHS must provide the capability to immediately disconnect or disable remote access to the hosted applications.V-221302MEDIUMNon-privileged accounts on the hosting system must only access OHS security-relevant information and functions through a distinct administrative account.V-221303MEDIUMOHS must have the client requests logging module loaded to generate log records for system startup and shutdown, system access, and system authentication logging.V-221304MEDIUMOHS must have OraLogMode set to Oracle Diagnostic Logging text mode to generate log records for system startup and shutdown, system access, and system authentication logging.V-221305MEDIUMOHS must have a log directory location defined to generate log records for system startup and shutdown, system access, and system authentication logging.V-221306MEDIUMOHS must have a log level severity defined to generate adequate log records for system startup and shutdown, system access, and system authentication events.V-221307MEDIUMOHS must have the log rotation parameter set to allow for the generation log records for system startup and shutdown, system access, and system authentication events.V-221308MEDIUMOHS must have a log format defined to generate adequate logs by system startup and shutdown, system access, and system authentication events.V-221309MEDIUMOHS must have a SSL log format defined to generate adequate logs by system startup and shutdown, system access, and system authentication events.V-221310MEDIUMOHS must have a log file defined for each site/virtual host to capture logs generated by system startup and shutdown, system access, and system authentication events.V-221312MEDIUMOHS must have a log level severity defined to produce sufficient log records to establish what type of events occurred.V-221313MEDIUMOHS must have a log format defined for log records generated to capture sufficient information to establish what type of events occurred.V-221314MEDIUMOHS must have a SSL log format defined for log records generated to capture sufficient information to establish what type of events occurred.V-221315MEDIUMOHS must have a log file defined for each site/virtual host to capture sufficient information to establish what type of events occurred.V-221316MEDIUMOHS must have a log format defined for log records generated to capture sufficient information to establish when an event occurred.V-221317MEDIUMOHS must have a SSL log format defined for log records generated to capture sufficient information to establish when an event occurred.V-221318MEDIUMOHS must have a log file defined for each site/virtual host to capture logs generated that allow the establishment of when an event occurred.V-221319MEDIUMOHS must have a log format defined for log records that allow the establishment of where within OHS the events occurred.V-221320MEDIUMOHS must have a SSL log format defined for log records that allow the establishment of where within OHS the events occurred.V-221321MEDIUMOHS must have a log file defined for each site/virtual host to capture logs generated that allow the establishment of where within OHS the events occurred.V-221322MEDIUMOHS must have a log format defined for log records that allow the establishment of the source of events.V-221323MEDIUMOHS must have a SSL log format defined for log records that allow the establishment of the source of events.V-221324MEDIUMOHS must have a log file defined for each site/virtual host to capture logs generated that allow the establishment of the source of events.V-221325MEDIUMOHS, behind a load balancer or proxy server, must produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.V-221326MEDIUMOHS, behind a load balancer or proxy server, must have the SSL log format set correctly to produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.V-221327MEDIUMOHS, behind a load balancer or proxy server, must have a log file defined for each site/virtual host to produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.V-221328MEDIUMOHS must have a log format defined to produce log records that contain sufficient information to establish the outcome (success or failure) of events.V-221329MEDIUMOHS must have a SSL log format defined to produce log records that contain sufficient information to establish the outcome (success or failure) of events.V-221330MEDIUMOHS must have a log file defined for each site/virtual host to produce log records that contain sufficient information to establish the outcome (success or failure) of events.V-221331MEDIUMOHS must have a log format defined to produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.V-221332MEDIUMOHS must have a SSL log format defined to produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.V-221333MEDIUMOHS must have a log file defined for each site/virtual host to produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.V-221334MEDIUMOHS log files must only be accessible by privileged users.V-221335MEDIUMThe log information from OHS must be protected from unauthorized modification.V-221336MEDIUMThe log information from OHS must be protected from unauthorized deletion.V-221337MEDIUMThe log data and records from OHS must be backed up onto a different system or media.V-221338MEDIUMOHS must be configured to store error log files to an appropriate storage device from which other tools can be configured to reference those log files for diagnostic/forensic purposes.V-221339MEDIUMOHS must be configured to store access log files to an appropriate storage device from which other tools can be configured to reference those log files for diagnostic/forensic purposes.V-221340MEDIUMOHS must have the LoadModule file_cache_module directive disabled.V-221341LOWOHS must have the LoadModule vhost_alias_module directive disabled.V-221342MEDIUMOHS must have the LoadModule env_module directive disabled.V-221343LOWOHS must have the LoadModule mime_magic_module directive disabled.V-221344LOWOHS must have the LoadModule negotiation_module directive disabled.V-221345LOWOHS must not have the LanguagePriority directive enabled.V-221346LOWOHS must not have the ForceLanguagePriority directive enabled.V-221347MEDIUMOHS must have the LoadModule status_module directive disabled.V-221348MEDIUMOHS must have the LoadModule info_module directive disabled.V-221349MEDIUMOHS must have the LoadModule include_module directive disabled.V-221350MEDIUMOHS must have the LoadModule autoindex_module directive disabled.V-221351MEDIUMOHS must have the IndexOptions directive disabled.V-221352MEDIUMOHS must have the AddIconByEncoding directive disabled.V-221353MEDIUMOHS must have the AddIconByType directive disabled.V-221354MEDIUMOHS must have the AddIcon directive disabled.V-221355MEDIUMOHS must have the DefaultIcon directive disabled.V-221356MEDIUMOHS must have the ReadmeName directive disabled.V-221357MEDIUMOHS must have the HeaderName directive disabled.V-221358MEDIUMOHS must have the IndexIgnore directive disabled.V-221359LOWOHS must have the LoadModule dir_module directive disabled.V-221360LOWOHS must have the DirectoryIndex directive disabled.V-221361MEDIUMOHS must have the LoadModule cgi_module directive disabled.V-221362MEDIUMOHS must have the LoadModule fastcgi_module disabled.V-221363MEDIUMOHS must have the LoadModule cgid_module directive disabled for mpm workers.V-221364LOWOHS must have the IfModule cgid_module directive disabled.V-221365LOWOHS must have the LoadModule mpm_winnt_module directive disabled.V-221366MEDIUMOHS must have the ScriptAlias directive for CGI scripts disabled.V-221367MEDIUMOHS must have the ScriptSock directive disabled.V-221368MEDIUMOHS must have the cgi-bin directory disabled.V-221369MEDIUMOHS must have directives pertaining to certain scripting languages removed from virtual hosts.V-221370LOWOHS must have the LoadModule asis_module directive disabled.V-221371LOWOHS must have the LoadModule imagemap_module directive disabled.V-221372MEDIUMOHS must have the LoadModule actions_module directive disabled.V-221373LOWOHS must have the LoadModule speling_module directive disabled.V-221374MEDIUMOHS must have the LoadModule userdir_module directive disabled.V-221375MEDIUMOHS must have the AliasMatch directive pertaining to the OHS manuals disabled.V-221376MEDIUMOHS must have the Directory directive pointing to the OHS manuals disabled.V-221377MEDIUMOHS must have the LoadModule auth_basic_module directive disabled.V-221378MEDIUMOHS must have the LoadModule authz_user_module directive disabled.V-221379MEDIUMOHS must have the LoadModule authn_file_module directive disabled.V-221380MEDIUMOHS must have the LoadModule authn_anon_module directive disabled.V-221381MEDIUMOHS must have the LoadModule proxy_module directive disabled.V-221382MEDIUMOHS must have the LoadModule proxy_http_module directive disabled.V-221383MEDIUMOHS must have the LoadModule proxy_ftp_module directive disabled.V-221384MEDIUMOHS must have the LoadModule proxy_connect_module directive disabled.V-221385MEDIUMOHS must have the LoadModule proxy_balancer_module directive disabled.V-221386LOWOHS must have the LoadModule cern_meta_module directive disabled.V-221387LOWOHS must have the LoadModule expires_module directive disabled.V-221388LOWOHS must have the LoadModule usertrack_module directive disabled.V-221389LOWOHS must have the LoadModule uniqueid_module directive disabled.V-221390MEDIUMOHS must have the LoadModule setenvif_module directive disabled.V-221391MEDIUMOHS must have the BrowserMatch directive disabled.V-221392MEDIUMOHS must have the LoadModule dumpio_module directive disabled.V-221393LOWOHS must have the IfModule dumpio_module directive disabled.V-221394MEDIUMOHS must have the Alias /icons/ directive disabled.V-221395MEDIUMOHS must have the path to the icons directory disabled.V-221396LOWOHS must have the IfModule mpm_winnt_module directive disabled.V-221397MEDIUMOHS must have the LoadModule proxy_module directive disabled.V-221398MEDIUMOHS must have the LoadModule proxy_http_module directive disabled.V-221399MEDIUMOHS must have the LoadModule proxy_ftp_module directive disabled.V-221400MEDIUMOHS must have the LoadModule proxy_connect_module directive disabled.V-221401MEDIUMOHS must have the LoadModule proxy_balancer_module directive disabled.V-221402LOWOHS must disable the directive pointing to the directory containing the OHS manuals.V-221403MEDIUMOHS must have the AliasMatch directive disabled for the OHS manuals.V-221404MEDIUMOHS must have the AddHandler directive disabled.V-221405MEDIUMOHS must have the LoadModule cgi_module directive disabled.V-221406MEDIUMOHS must have the LoadModule cgid_module directive disabled.V-221407MEDIUMOHS must have the IfModule cgid_module directive disabled for the OHS server, virtual host, and directory configuration.V-221408LOWOHS must have the LoadModule cgi_module directive disabled within the IfModule mpm_winnt_module directive.V-221409MEDIUMOHS must have the ScriptAlias /cgi-bin/ directive within a IfModule alias_module directive disabled.V-221410MEDIUMOHS must have the ScriptSock directive within a IfModule cgid_module directive disabled.V-221411MEDIUMOHS must have the cgi-bin directory disabled.V-221412MEDIUMOHS must have directives pertaining to certain scripting languages removed from virtual hosts.V-221413MEDIUMOHS must have resource mappings set to disable the serving of certain file types.V-221414MEDIUMUsers and scripts running on behalf of users must be contained to the document root or home directory tree of OHS.V-221415MEDIUMOHS must be configured to use a specified IP address, port, and protocol.V-221416MEDIUMThe Node Manager account password associated with the installation of OHS must be in accordance with DoD guidance for length, complexity, etc.V-221417MEDIUMOHS must have Entity tags (ETags) disabled.V-221418MEDIUMThe SecureListener property of the Node Manager configured to support OHS must be enabled for secure communication.V-221419MEDIUMThe ListenAddress property of the Node Manager configured to support OHS must match the CN of the certificate used by Node Manager.V-221420MEDIUMThe AuthenticationEnabled property of the Node Manager configured to support OHS must be configured to enforce authentication.V-221421MEDIUMThe KeyStores property of the Node Manager configured to support OHS must be configured for secure communication.V-221422MEDIUMThe CustomIdentityKeyStoreFileName property of the Node Manager configured to support OHS must be configured for secure communication.V-221423MEDIUMThe CustomIdentityKeyStorePassPhrase property of the Node Manager configured to support OHS must be configured for secure communication.V-221424MEDIUMThe CustomIdentityAlias property of the Node Manager configured to support OHS must be configured for secure communication.V-221425MEDIUMThe CustomIdentityPrivateKeyPassPhrase property of the Node Manager configured to support OHS must be configured for secure communication.V-221426MEDIUMThe listen-address element defined within the config.xml of the OHS Standalone domain that supports OHS must be configured for secure communication.V-221427MEDIUMThe listen-port element defined within the config.xml of the OHS Standalone Domain must be configured for secure communication.V-221428MEDIUMThe WLST_PROPERTIES environment variable defined for the OHS WebLogic Scripting Tool must be updated to reference an appropriate trust store so that it can communicate with the Node Manager supporting OHS.V-221429MEDIUMThe WLST_PROPERTIES environment variable defined for the Fusion Middleware WebLogic Scripting Tool must be updated to reference an appropriate trust store so that it can communicate with the Node Manager supporting OHS.V-221430MEDIUMOHS must limit access to the Dynamic Monitoring Service (DMS).V-221431MEDIUMOHS must have the AllowOverride directive set properly.V-221432MEDIUMOHS must be set to evaluate deny directives first when considering whether to serve a file.V-221433MEDIUMOHS must deny all access by default when considering whether to serve a file.V-221434MEDIUMThe OHS instance installation must not contain an .htaccess file.V-221435MEDIUMThe OHS instance configuration must not reference directories that contain an .htaccess file.V-221436LOWOHS must have the HostnameLookups directive enabled.V-221437MEDIUMOHS must have the ServerAdmin directive set properly.V-221438MEDIUMOHS must restrict access methods.V-221439MEDIUMThe OHS htdocs directory must not contain any default files.V-221440MEDIUMOHS must have the SSLSessionCacheTimeout directive set properly.V-221441LOWOHS must have the RewriteEngine directive enabled.V-221442LOWOHS must have the RewriteOptions directive set properly.V-221443LOWOHS must have the RewriteLogLevel directive set to the proper log level.V-221444LOWOHS must have the RewriteLog directive set properly.V-221445MEDIUMAll accounts installed with the web server software and tools must have passwords assigned and default passwords changed.V-221446MEDIUMA production OHS Installation must prohibit the installation of a compiler.V-221447MEDIUMA public OHS installation, if hosted on the NIPRNet, must be isolated in an accredited DoD DMZ Extension.V-221448MEDIUMA private OHS installation must be located on a separate controlled access subnet.V-221449HIGHThe version of the OHS installation must be vendor supported.V-221450MEDIUMOHS must be certified with accompanying Fusion Middleware products.V-221451MEDIUMOHS tools must be restricted to the web manager and the web managers designees.V-221452LOWAll utility programs, not necessary for operations, must be removed or disabled.V-221453MEDIUMThe OHS htpasswd files (if present) must reflect proper ownership and permissions.V-221454MEDIUMA public OHS installation must limit email to outbound only.V-221455LOWOHS content and configuration files must be part of a routine backup program.V-221456MEDIUMOHS must be segregated from other services.V-221457MEDIUMOHS must have all applicable patches (i.e., CPUs) applied/documented (OEM).V-221458MEDIUMA private OHS list of CAs in a trust hierarchy must lead to an authorized DoD PKI Root CA.V-221459MEDIUMOHS must have the ScoreBoardFile directive disabled.V-221460MEDIUMThe OHS document root directory must not be on a network share.V-221461MEDIUMThe OHS server root directory must not be on a network share.V-221462HIGHSymbolic links must not be used in the web content directory tree.V-221463HIGHOHS administration must be performed over a secure path or at the local console.V-221464MEDIUMOHS must not contain any robots.txt files.V-221465MEDIUMOHS must prohibit anonymous FTP user access to interactive scripts.V-221466MEDIUMThe OHS DocumentRoot directory must be in a separate partition from the OHS ServerRoot directory.V-221467MEDIUMThe OHS DocumentRoot directory must be on a separate partition from OS root partition.V-221468MEDIUMRemote authors or content providers must have all files scanned for viruses and malicious code before uploading files to the Document Root directory.V-221469MEDIUMA public OHS server must use TLS if authentication is required to host web sites.V-221470LOWOHS hosted web sites must utilize ports, protocols, and services according to PPSM guidelines.V-221471HIGHOHS must not have the directive PlsqlDatabasePassword set in clear text.V-221472MEDIUMIf WebLogic is not in use with OHS, OHS must have the include mod_wl_ohs.conf directive disabled at the server level.V-221473MEDIUMIf mod_plsql is not in use with OHS, OHS must have the include moduleconf/* directive disabled.V-221474HIGHOHS must have the LoadModule ossl_module directive enabled to encrypt passwords during transmission.V-221475HIGHOHS must use FIPS modules to encrypt passwords during transmission.V-221476HIGHOHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to encrypt passwords during transmission.V-221477HIGHOHS must have the SSLCipherSuite directive enabled to encrypt passwords during transmission.V-221478MEDIUMOHS must have the LoadModule ossl_module directive enabled to perform RFC 5280-compliant certification path validation.V-221479MEDIUMOHS must use FIPS modules to perform RFC 5280-compliant certification path validation.V-221480MEDIUMOHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to perform RFC 5280-compliant certification path validation.V-221481MEDIUMOHS must have the SSLCipherSuite directive enabled to perform RFC 5280-compliant certification path validation.V-221482MEDIUMOHS must have the SSLVerifyClient directive set within each SSL-enabled VirtualHost directive to perform RFC 5280-compliant certification path validation.V-221483MEDIUMOHS must have the SSLCARevocationFile and SSLCRLCheck directives within each SSL-enabled VirtualHost directive set to perform RFC 5280-compliant certification path validation when using single certification revocation.V-221484MEDIUMOHS must have SSLCARevocationPath and SSLCRLCheck directives within each SSL-enabled VirtualHost directive set to perform RFC 5280-compliant certification path validation when using multiple certification revocation.V-221485MEDIUMOHS must be integrated with a tool such as Oracle Access Manager to enforce a client-side certificate revocation check through the OCSP protocol.V-221486MEDIUMOHS must have the LoadModule ossl_module directive enabled to meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when encrypting stored data.V-221487MEDIUMOHS must have the SSLFIPS directive enabled to meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when encrypting stored data.V-221488MEDIUMOHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled to meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when encrypting stored data.V-221489MEDIUMOHS must have the SSLCipherSuite directive enabled to meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when encrypting stored data.V-221490MEDIUMOHS must have the LoadModule ossl_module directive enabled to meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.V-221491MEDIUMOHS must have the SSLFIPS directive enabled to meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.V-221492MEDIUMOHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.V-221493MEDIUMOHS must have the SSLCipherSuite directive enabled to meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.V-221494MEDIUMOHS utilizing mobile code must meet DoD-defined mobile code requirements.V-221495HIGHOHS accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.V-221496MEDIUMOHS must have the DocumentRoot directive set to a separate partition from the OHS system files.V-221497MEDIUMOHS must have the Directory directive accompanying the DocumentRoot directive set to a separate partition from the OHS system files.V-221498MEDIUMOHS must have the Timeout directive properly set to restrict the ability of users to launch Denial of Service (DoS) attacks against other information systems or networks.V-221499MEDIUMOHS must have the KeepAlive directive properly set to restrict the ability of users to launch Denial of Service (DoS) attacks against other information systems or networks.V-221500MEDIUMOHS must have the KeepAliveTimeout properly set to restrict the ability of users to launch Denial of Service (DoS) attacks against other information systems or networks.V-221501MEDIUMOHS must have the MaxKeepAliveRequests directive properly set to restrict the ability of users to launch Denial of Service (DoS) attacks against other information systems or networks.V-221502MEDIUMOHS must have the ListenBacklog properly set to restrict the ability of users to launch Denial of Service (DoS) attacks against other information systems or networks.V-221503MEDIUMOHS must have the LimitRequestBody directive set to restrict the ability of users to launch Denial of Service (DoS) attacks against other information systems or networks.V-221504MEDIUMOHS must have the LimitRequestFields directive set to restrict the ability of users to launch Denial of Service (DoS) attacks against other information systems or networks.V-221505MEDIUMOHS must have the LimitRequestFieldSize directive set to restrict the ability of users to launch Denial of Service (DoS) attacks against other information systems or networks.V-221506MEDIUMOHS must have the LimitRequestLine directive set to restrict the ability of users to launch Denial of Service (DoS) attacks against other information systems or networks.V-221507MEDIUMOHS must have the LimitXMLRequestBody directive set to restrict the ability of users to launch Denial of Service (DoS) attacks against other information systems or networks.V-221508MEDIUMOHS must have the LimitInternalRecursion directive set to restrict the ability of users to launch Denial of Service (DoS) attacks against other information systems or networks.V-221513MEDIUMOHS must have the LoadModule ossl_module directive enabled so SSL requests can be processed with client certificates only issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).V-221514MEDIUMOHS must have the SSLFIPS directive enabled so SSL requests can be processed with client certificates only issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).V-221515MEDIUMOHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled so SSL requests can be processed with client certificates only issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).V-221516MEDIUMOHS must have the SSLCipherSuite directive enabled so SSL requests can be processed with client certificates only issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).V-221517MEDIUMOHS must have the SSLVerifyClient directive enabled to only accept client certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).V-221518MEDIUMOHS must use wallets that have only DoD certificate authorities defined.V-221519MEDIUMOHS must be tuned to handle the operational requirements of the hosted application.V-221520HIGHOHS must have the LoadModule ossl_module directive enabled to prevent unauthorized disclosure of information during transmission.V-221521HIGHOHS must have the SSLFIPS directive enabled to prevent unauthorized disclosure of information during transmission.V-221522HIGHOHS must have the SSLEngine, SSLProtocol, SSLWallet directives enabled and configured to prevent unauthorized disclosure of information during transmission.V-221523HIGHOHS must have the SSLCipherSuite directive enabled to prevent unauthorized disclosure of information during transmission.V-221524MEDIUMIf using the WebLogic Web Server Proxy Plugin and configuring end-to-end SSL, OHS must have the SecureProxy directive enabled to prevent unauthorized disclosure of information during transmission.V-221525MEDIUMOHS must have the WLSSLWallet directive enabled to prevent unauthorized disclosure of information during transmission.V-221526MEDIUMIf using the WebLogic Web Server Proxy Plugin and configuring end-to-end SSL, OHS must have the WebLogicSSLVersion directive enabled to prevent unauthorized disclosure of information during transmission.V-221527MEDIUMIf using the WebLogic Web Server Proxy Plugin and configuring SSL termination at OHS, OHS must have the WLProxySSL directive enabled to prevent unauthorized disclosure of information during transmission.V-221528MEDIUMOHS must have the LoadModule ossl_module directive enabled to maintain the confidentiality of controlled information during transmission through the use of an approved TLS version.V-221529MEDIUMOHS must have the SSLFIPS directive enabled to maintain the confidentiality of controlled information during transmission through the use of an approved TLS version.V-221530MEDIUMOHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to maintain the confidentiality of controlled information during transmission through the use of an approved TLS version.V-221531MEDIUMOHS must have the SSLCipherSuite directive enabled to maintain the confidentiality of controlled information during transmission through the use of an approved TLS version.V-221532MEDIUMOHS must have the LoadModule ossl_module directive enabled to maintain the confidentiality and integrity of information during preparation for transmission.V-221533MEDIUMOHS must have the SSLFIPS directive enabled to maintain the confidentiality and integrity of information during preparation for transmission.V-221534MEDIUMOHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to maintain the confidentiality and integrity of information during preparation for transmission.V-221535MEDIUMOHS must have the SSLCipherSuite directive enabled to maintain the confidentiality and integrity of information during preparation for transmission.V-221536MEDIUMIf using the WebLogic Web Server Proxy Plugin and configuring end-to-end SSL, OHS must have the SecureProxy directive enabled to maintain the confidentiality and integrity of information during preparation for transmission.V-221537MEDIUMIf using the WebLogic Web Server Proxy Plugin and configuring end-to-end SSL, OHS must have the WLSSLWallet directive enabled to maintain the confidentiality and integrity of information during preparation for transmission.V-221538MEDIUMIf using the WebLogic Web Server Proxy Plugin and configuring SSL termination at OHS, OHS must have the WLSProxySSL directive enabled to maintain the confidentiality and integrity of information during preparation for transmission.V-221539MEDIUMOHS must have the LoadModule ossl_module directive enabled to maintain the confidentiality and integrity of information during reception.V-221540MEDIUMOHS must have the SSLFIPS directive enabled to maintain the confidentiality and integrity of information during reception.V-221541MEDIUMOHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to maintain the confidentiality and integrity of information during reception.V-221542MEDIUMOHS must have the SSLCipherSuite directive enabled to maintain the confidentiality and integrity of information during reception.V-221543MEDIUMIf using the WebLogic Web Server Proxy Plugin and configuring end-to-end SSL, OHS must have the SSLSecureProxy directive enabled to maintain the confidentiality and integrity of information during reception.V-221544MEDIUMIf using the WebLogic Web Server Proxy Plugin and configuring end-to-end SSL, OHS must have the WLSSLWallet directive enabled to maintain the confidentiality and integrity of information during reception.V-221545MEDIUMIf using the WebLogic Web Server Proxy Plugin and configuring SSL termination at OHS, OHS must have the WLProxySSL directive enabled to maintain the confidentiality and integrity of information during reception.V-221546LOWOHS must display a default hosted application web page, not a directory listing, when a requested web page cannot be found.V-221547MEDIUMOHS must have the ServerSignature directive disabled.V-221548LOWOHS must have the ServerTokens directive set to limit the response header.V-221549MEDIUMOHS must have the Alias /error directive defined to reference the directory accompanying the ErrorDocument directives to minimize the identity of OHS, patches, loaded modules, and directory paths in warning and error messages displayed to clients.V-221550MEDIUMOHS must have the permissions set properly via the Directory directive accompanying the ErrorDocument directives to minimize improper access to the warning and error messages displayed to clients.V-221551LOWOHS must have defined error pages for common error codes that minimize the identity of the web server, patches, loaded modules, and directory paths.V-221552LOWOHS must have production information removed from error documents to minimize the identity of OHS, patches, loaded modules, and directory paths in warning and error messages displayed to clients.V-221553MEDIUMDebugging and trace information used to diagnose OHS must be disabled.V-252204MEDIUMOHS must capture, record, and log all content related to a user session.V-252205HIGHOHS must have the LoadModule ossl_module directive enabled to implement required cryptographic protections using cryptographic modules complying with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when encrypting data that must be compartmentalized.V-252546HIGHOHS must have the SSLFIPS directive enabled to implement required cryptographic protections using cryptographic modules complying with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when encrypting data that must be compartmentalized.