AS24-W1-000010 - The Apache web server must limit the number of allowed simultaneous session requests.

800-53|AC-10

CAT|II

CCI|CCI-000054

Rule-ID|SV-214306r505936_rule

STIG-ID|AS24-W1-000010

STIG-Legacy|SV-102415

STIG-Legacy|V-92327

Vuln-ID|V-214306

AS24-W1-000020 - The Apache web server must perform server-side session management - session_module

Rule-ID|SV-214307r505936_rule

STIG-ID|AS24-W1-000020

STIG-Legacy|SV-102417

STIG-Legacy|V-92329

Vuln-ID|V-214307

AS24-W1-000020 - The Apache web server must perform server-side session management - usertrack_module

AS24-W1-000030 - The Apache web server must use encryption strength in accordance with the categorization of data hosted by the Apache web server when remote connections are provided - ssl_module

800-53|SC-8

CCI|CCI-000068

CCI|CCI-000213

CCI|CCI-000803

CCI|CCI-001453

CCI|CCI-002418

CCI|CCI-002422

Rule-ID|SV-214308r505936_rule

STIG-ID|AS24-W1-000030

STIG-Legacy|SV-102419

STIG-Legacy|V-92331

Vuln-ID|V-214308

AS24-W1-000030 - The Apache web server must use encryption strength in accordance with the categorization of data hosted by the Apache web server when remote connections are provided - SSLProtocol

800-53|AC-3

800-53|AC-17(2)

800-53|IA-5(1)

800-53|IA-7

800-53|SC-8(2)

800-53|SC-18(1)

800-53|SC-28(1)

AS24-W1-000065 - System logging must be enabled.

800-53|CM-6

CCI|CCI-000366

Rule-ID|SV-214309r505936_rule

STIG-ID|AS24-W1-000065

STIG-Legacy|SV-102425

STIG-Legacy|V-92337

Vuln-ID|V-214309

AS24-W1-000070 - The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.

800-53|AU-8

CCI|CCI-000169

CCI|CCI-001464

Rule-ID|SV-214310r505936_rule

STIG-ID|AS24-W1-000070

STIG-Legacy|SV-102427

STIG-Legacy|V-92339

Vuln-ID|V-214310

AS24-W1-000090 - The Apache web server must produce log records containing sufficient information to establish what type of events occurred.

800-53|AU-3

800-53|AU-12

800-53|AU-14(1)

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-001487

Rule-ID|SV-214311r505936_rule

STIG-ID|AS24-W1-000090

STIG-Legacy|SV-102431

STIG-Legacy|V-92343

Vuln-ID|V-214311

AS24-W1-000130 - An Apache web server, behind a load balancer or proxy server, must produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.

Rule-ID|SV-214312r505936_rule

STIG-ID|AS24-W1-000130

STIG-Legacy|SV-102439

STIG-Legacy|V-92351

Vuln-ID|V-214312

AS24-W1-000160 - The Apache web server must use a logging mechanism that is configured to alert the (ISSO) and System Administrator (SA) in the event of a processing failure.

CCI|CCI-000139

Rule-ID|SV-214313r505936_rule

STIG-ID|AS24-W1-000160

STIG-Legacy|SV-102445

STIG-Legacy|V-92357

Vuln-ID|V-214313

AS24-W1-000180 - The Apache web server log files must only be accessible by privileged users.

800-53|AU-9

CCI|CCI-000162

Rule-ID|SV-214314r505936_rule

STIG-ID|AS24-W1-000180

STIG-Legacy|SV-102447

STIG-Legacy|V-92359

Vuln-ID|V-214314

AS24-W1-000200 - The log information from the Apache web server must be protected from unauthorized deletion and modification.

CCI|CCI-000163

CCI|CCI-000164

Rule-ID|SV-214315r505936_rule

STIG-ID|AS24-W1-000200

STIG-Legacy|SV-102451

STIG-Legacy|V-92363

Vuln-ID|V-214315

AS24-W1-000210 - The log data and records from the Apache web server must be backed up onto a different system or media.

CCI|CCI-001348

Rule-ID|SV-214316r505936_rule

STIG-ID|AS24-W1-000210

STIG-Legacy|SV-102453

STIG-Legacy|V-92365

Vuln-ID|V-214316

AS24-W1-000240 - The Apache web server must not perform user management for hosted applications.

CCI|CCI-000381

Rule-ID|SV-214318r505936_rule

STIG-ID|AS24-W1-000240

STIG-Legacy|SV-102457

STIG-Legacy|V-92369

Vuln-ID|V-214318

AS24-W1-000250 - The Apache web server must only contain services and functions necessary for operation - conf/extra/proxy-html.conf

800-53|CM-7

Rule-ID|SV-214319r505936_rule

STIG-ID|AS24-W1-000250

STIG-Legacy|SV-102459

STIG-Legacy|V-92371

Vuln-ID|V-214319

AS24-W1-000250 - The Apache web server must only contain services and functions necessary for operation - httpd-manual package

AS24-W1-000250 - The Apache web server must only contain services and functions necessary for operation - SetHandler other

AS24-W1-000250 - The Apache web server must only contain services and functions necessary for operation - SetHandler server-info

AS24-W1-000250 - The Apache web server must only contain services and functions necessary for operation - SetHandler server-status

AS24-W1-000250 - The Apache web server must only contain services and functions necessary for operation - Welcome page

AS24-W1-000260 - The Apache web server must not be a proxy server.

Rule-ID|SV-214320r505936_rule

STIG-ID|AS24-W1-000260

STIG-Legacy|SV-102461

STIG-Legacy|V-92373

Vuln-ID|V-214320

AS24-W1-000270 - The Apache web server must provide install options to exclude the installation of documentation, sample code, example applications, and tutorials.

CAT|I

Rule-ID|SV-214321r505936_rule

STIG-ID|AS24-W1-000270

STIG-Legacy|SV-102463

STIG-Legacy|V-92375

Vuln-ID|V-214321

AS24-W1-000280 - Apache web server application directories,  libraries, and configuration files must only be accessible to privileged users.

CCI|CCI-001082

CCI|CCI-001813

Rule-ID|SV-214322r505936_rule

STIG-ID|AS24-W1-000280

STIG-Legacy|SV-102465

STIG-Legacy|V-92377

Vuln-ID|V-214322

AS24-W1-000300 - The Apache web server must have resource mappings set to disable the serving of certain file types.

Rule-ID|SV-214323r505936_rule

STIG-ID|AS24-W1-000300

STIG-Legacy|SV-102469

STIG-Legacy|V-92381

Vuln-ID|V-214323

AS24-W1-000310 - The Apache web server must allow the mappings to unused and vulnerable scripts to be removed.

Rule-ID|SV-214324r505936_rule

STIG-ID|AS24-W1-000310

STIG-Legacy|SV-102471

STIG-Legacy|V-92383

Vuln-ID|V-214324

AS24-W1-000330 - The Apache web server must have Web Distributed Authoring (WebDAV) disabled.

Rule-ID|SV-214325r505936_rule

STIG-ID|AS24-W1-000330

STIG-Legacy|SV-102475

STIG-Legacy|V-92387

Vuln-ID|V-214325

AS24-W1-000360 - The Apache web server must be configured to use a specified IP address and port - IP or Port Only

800-53|IA-5(2)

CCI|CCI-000382

Rule-ID|SV-214326r505936_rule

STIG-ID|AS24-W1-000360

STIG-Legacy|SV-102477

STIG-Legacy|V-92389

Vuln-ID|V-214326

AS24-W1-000360 - The Apache web server must be configured to use a specified IP address and port - Zero IPs Only

AS24-W1-000370 - The Apache web server must encrypt passwords during transmission.

CCI|CCI-000197

Rule-ID|SV-214327r505936_rule

STIG-ID|AS24-W1-000370

STIG-Legacy|SV-102479

STIG-Legacy|V-92391

Vuln-ID|V-214327

AS24-W1-000380 - The Apache web server must perform RFC 5280-compliant certification path validation.

800-53|SC-23(5)

CCI|CCI-000185

Rule-ID|SV-214328r505936_rule

STIG-ID|AS24-W1-000380

STIG-Legacy|SV-102481

STIG-Legacy|V-92393

Vuln-ID|V-214328

AS24-W1-000430 - Apache web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.

Rule-ID|SV-214329r505936_rule

STIG-ID|AS24-W1-000430

STIG-Legacy|SV-102487

STIG-Legacy|V-92399

Vuln-ID|V-214329

AS24-W1-000450 - The Apache web server must separate the hosted applications from hosted Apache web server management functionality.

Rule-ID|SV-214330r505936_rule

STIG-ID|AS24-W1-000450

STIG-Legacy|SV-102491

STIG-Legacy|V-92403

Vuln-ID|V-214330

AS24-W1-000460 - The Apache web server must invalidate session identifiers upon hosted application user logout or other session termination.

800-53|AC-12

Detections

Analytics

Revision 1.6

Nov 4, 2022

Functional Update