AS24-W1-000010 - The Apache web server must limit the number of allowed simultaneous session requests.

CAT|II

CCI|CCI-000054

Rule-ID|SV-214306r960735_rule

STIG-ID|AS24-W1-000010

STIG-Legacy|SV-102415

STIG-Legacy|V-92327

Vuln-ID|V-214306

AS24-W1-000020 - The Apache web server must perform server-side session management - session_module

Rule-ID|SV-214307r960735_rule

STIG-ID|AS24-W1-000020

STIG-Legacy|SV-102417

STIG-Legacy|V-92329

Vuln-ID|V-214307

AS24-W1-000020 - The Apache web server must perform server-side session management - usertrack_module

AS24-W1-000030 - The Apache web server must use encryption strength in accordance with the categorization of data hosted by the Apache web server when remote connections are provided - ssl_module

CCI|CCI-000068

CCI|CCI-000213

CCI|CCI-000803

CCI|CCI-001453

CCI|CCI-002418

CCI|CCI-002422

Rule-ID|SV-214308r960759_rule

STIG-ID|AS24-W1-000030

STIG-Legacy|SV-102419

STIG-Legacy|V-92331

Vuln-ID|V-214308

AS24-W1-000030 - The Apache web server must use encryption strength in accordance with the categorization of data hosted by the Apache web server when remote connections are provided - SSLProtocol

AS24-W1-000065 - System logging must be enabled.

CCI|CCI-000366

Rule-ID|SV-214309r961863_rule

STIG-ID|AS24-W1-000065

STIG-Legacy|SV-102425

STIG-Legacy|V-92337

Vuln-ID|V-214309

AS24-W1-000070 - The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.

CCI|CCI-000169

CCI|CCI-001464

Rule-ID|SV-214310r960879_rule

STIG-ID|AS24-W1-000070

STIG-Legacy|SV-102427

STIG-Legacy|V-92339

Vuln-ID|V-214310

AS24-W1-000090 - The Apache web server must produce log records containing sufficient information to establish what type of events occurred.

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-001487

Rule-ID|SV-214311r962395_rule

STIG-ID|AS24-W1-000090

STIG-Legacy|SV-102431

STIG-Legacy|V-92343

Vuln-ID|V-214311

AS24-W1-000130 - An Apache web server, behind a load balancer or proxy server, must produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.

Rule-ID|SV-214312r960900_rule

STIG-ID|AS24-W1-000130

STIG-Legacy|SV-102439

STIG-Legacy|V-92351

Vuln-ID|V-214312

AS24-W1-000160 - The Apache web server must use a logging mechanism that is configured to alert the (ISSO) and System Administrator (SA) in the event of a processing failure.

CCI|CCI-000139

Rule-ID|SV-214313r960912_rule

STIG-ID|AS24-W1-000160

STIG-Legacy|SV-102445

STIG-Legacy|V-92357

Vuln-ID|V-214313

AS24-W1-000180 - The Apache web server log files must only be accessible by privileged users.

CCI|CCI-000162

Rule-ID|SV-214314r960930_rule

STIG-ID|AS24-W1-000180

STIG-Legacy|SV-102447

STIG-Legacy|V-92359

Vuln-ID|V-214314

AS24-W1-000200 - The log information from the Apache web server must be protected from unauthorized deletion and modification.

CCI|CCI-000163

CCI|CCI-000164

Rule-ID|SV-214315r960936_rule

STIG-ID|AS24-W1-000200

STIG-Legacy|SV-102451

STIG-Legacy|V-92363

Vuln-ID|V-214315

AS24-W1-000210 - The log data and records from the Apache web server must be backed up onto a different system or media.

CCI|CCI-001348

Rule-ID|SV-214316r960948_rule

STIG-ID|AS24-W1-000210

STIG-Legacy|SV-102453

STIG-Legacy|V-92365

Vuln-ID|V-214316

AS24-W1-000240 - The Apache web server must not perform user management for hosted applications.

CCI|CCI-000381

Rule-ID|SV-214318r960963_rule

STIG-ID|AS24-W1-000240

STIG-Legacy|SV-102457

STIG-Legacy|V-92369

Vuln-ID|V-214318

AS24-W1-000250 - The Apache web server must only contain services and functions necessary for operation - conf/extra/proxy-html.conf

Rule-ID|SV-214319r960963_rule

STIG-ID|AS24-W1-000250

STIG-Legacy|SV-102459

STIG-Legacy|V-92371

Vuln-ID|V-214319

AS24-W1-000250 - The Apache web server must only contain services and functions necessary for operation - httpd-manual package

AS24-W1-000250 - The Apache web server must only contain services and functions necessary for operation - SetHandler other

AS24-W1-000250 - The Apache web server must only contain services and functions necessary for operation - SetHandler server-info

AS24-W1-000250 - The Apache web server must only contain services and functions necessary for operation - SetHandler server-status

AS24-W1-000250 - The Apache web server must only contain services and functions necessary for operation - Welcome page

AS24-W1-000260 - The Apache web server must not be a proxy server.

Rule-ID|SV-214320r960963_rule

STIG-ID|AS24-W1-000260

STIG-Legacy|SV-102461

STIG-Legacy|V-92373

Vuln-ID|V-214320

AS24-W1-000270 - The Apache web server must provide install options to exclude the installation of documentation, sample code, example applications, and tutorials.

CAT|I

Rule-ID|SV-214321r960963_rule

STIG-ID|AS24-W1-000270

STIG-Legacy|SV-102463

STIG-Legacy|V-92375

Vuln-ID|V-214321

AS24-W1-000280 - Apache web server application directories,  libraries, and configuration files must only be accessible to privileged users.

CCI|CCI-001082

CCI|CCI-001813

Rule-ID|SV-214322r960963_rule

STIG-ID|AS24-W1-000280

STIG-Legacy|SV-102465

STIG-Legacy|V-92377

Vuln-ID|V-214322

AS24-W1-000300 - The Apache web server must have resource mappings set to disable the serving of certain file types.

Rule-ID|SV-214323r960963_rule

STIG-ID|AS24-W1-000300

STIG-Legacy|SV-102469

STIG-Legacy|V-92381

Vuln-ID|V-214323

AS24-W1-000310 - The Apache web server must allow the mappings to unused and vulnerable scripts to be removed.

Rule-ID|SV-214324r960963_rule

STIG-ID|AS24-W1-000310

STIG-Legacy|SV-102471

STIG-Legacy|V-92383

Vuln-ID|V-214324

AS24-W1-000330 - The Apache web server must have Web Distributed Authoring (WebDAV) disabled.

Rule-ID|SV-214325r960963_rule

STIG-ID|AS24-W1-000330

STIG-Legacy|SV-102475

STIG-Legacy|V-92387

Vuln-ID|V-214325

AS24-W1-000360 - The Apache web server must be configured to use a specified IP address and port - IP or Port Only

CCI|CCI-000382

Rule-ID|SV-214326r960966_rule

STIG-ID|AS24-W1-000360

STIG-Legacy|SV-102477

STIG-Legacy|V-92389

Vuln-ID|V-214326

AS24-W1-000360 - The Apache web server must be configured to use a specified IP address and port - Zero IPs Only

AS24-W1-000370 - The Apache web server must encrypt passwords during transmission.

CCI|CCI-000197

Rule-ID|SV-214327r961029_rule

STIG-ID|AS24-W1-000370

STIG-Legacy|SV-102479

STIG-Legacy|V-92391

Vuln-ID|V-214327

AS24-W1-000380 - The Apache web server must perform RFC 5280-compliant certification path validation.

CCI|CCI-000185

Rule-ID|SV-214328r961038_rule

STIG-ID|AS24-W1-000380

STIG-Legacy|SV-102481

STIG-Legacy|V-92393

Vuln-ID|V-214328

AS24-W1-000430 - Apache web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.

Rule-ID|SV-214329r961095_rule

STIG-ID|AS24-W1-000430

STIG-Legacy|SV-102487

STIG-Legacy|V-92399

Vuln-ID|V-214329

AS24-W1-000450 - The Apache web server must separate the hosted applications from hosted Apache web server management functionality.

Rule-ID|SV-214330r961095_rule

STIG-ID|AS24-W1-000450

STIG-Legacy|SV-102491

STIG-Legacy|V-92403

Vuln-ID|V-214330

AS24-W1-000460 - The Apache web server must invalidate session identifiers upon hosted application user logout or other session termination.

CCI|CCI-001185

Rule-ID|SV-214331r961113_rule

STIG-ID|AS24-W1-000460

STIG-Legacy|SV-102493

STIG-Legacy|V-92405

Vuln-ID|V-214331

AS24-W1-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - Header HttpOnly secure

CCI|CCI-001664

Rule-ID|SV-214332r961116_rule

STIG-ID|AS24-W1-000470

STIG-Legacy|SV-102495

STIG-Legacy|V-92407

Vuln-ID|V-214332

AS24-W1-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - Javascript setCookie

AS24-W1-000480 - The Apache web server must accept only system-generated session identifiers.

CCI|CCI-001188

Rule-ID|SV-214333r961116_rule

STIG-ID|AS24-W1-000480

STIG-Legacy|SV-102497

Detections

Analytics

DISA STIG Apache Server 2.4 Windows Server v3r1

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Jun 16, 2025 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Jan 6, 2025 Miscellaneous Metadata updated.