Check: WA00530 A22
APACHE Server 2.0 for Unix:
WA00530 A22
(in version v1 r5)
Title
The process ID (PID) file must be properly secured. (Cat II impact)
Discussion
The PidFile directive sets the file path to the process ID file to which the server records the process id of the server, which is useful for sending a signal to the server process or for checking on the health of the process. If the PidFile is placed in a writable directory, other accounts could create a denial of service attack and prevent the server from starting by creating a PID file with the same name.
Check Content
Enter the following command: more /usr/local/Apache2.2/conf/httpd.conf. Review the httpd.conf file and search for the following uncommented directive: PidFile Note the location and name of the PID file. If the PidFile directive is not found enabled in the conf file, use /logs as the directory containing the Scoreboard file. Verify the permissions and ownership on the folder containing the PID file. If any user accounts other than root, auditor, or the account used to run the web server have permission to, or ownership of, this folder, this is a finding. If the PID file is located in the web server DocumentRoot this is a finding.
Fix Text
Modify the location, permissions, and/or ownership for the PID file folder.
Additional Identifiers
Rule ID: SV-33222r1_rule
Vulnerability ID: V-26305
Group Title: WA00530
Expert Comments
CCIs
Number | Definition |
---|---|
No CCIs are assigned to this check |
Controls
Number | Title |
---|---|
No controls are assigned to this check |