Check: AS24-U1-000780
Apache Server 2.4 UNIX Server STIG:
AS24-U1-000780
(in versions v2 r6 through v1 r0.1)
Title
The Apache web server must prohibit or restrict the use of nonsecure or unnecessary ports, protocols, modules, and/or services. (Cat II impact)
Discussion
Web servers provide numerous processes, features, and functionalities that use TCP/IP ports. Some of these processes may be deemed unnecessary or too unsecure to run on a production system. The Apache web server must provide the capability to disable or deactivate network-related services that are deemed to be non-essential to the server mission, are too unsecure, or are prohibited by the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments.
Check Content
Review the website to determine if HTTP and HTTPs are used in accordance with well known ports (e.g., 80 and 443) or those ports and services as registered and approved for use by the DoD PPSM. Any variation in PPS will be documented, registered, and approved by the PPSM. If not, this is a finding.
Fix Text
Ensure the website enforces the use of IANA well-known ports for HTTP and HTTPS.
Additional Identifiers
Rule ID: SV-214266r879756_rule
Vulnerability ID: V-214266
Group Title: SRG-APP-000383-WSR-000175
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001762 |
The organization disables organization-defined functions, ports, protocols, and services within the information system deemed to be unnecessary and/or nonsecure. |
Controls
Number | Title |
---|---|
CM-7 (1) |
Periodic Review |