AS24-U2-000020 - The Apache web server must perform server-side session management - session_module

CAT|II

CCI|CCI-000054

Rule-ID|SV-214277r879511_rule

STIG-ID|AS24-U2-000020

STIG-Legacy|SV-102849

STIG-Legacy|V-92761

Vuln-ID|V-214277

AS24-U2-000020 - The Apache web server must perform server-side session management - usertrack_module

AS24-U2-000030 - The Apache web server must use encryption strength in accordance with the categorization of data hosted by the Apache web server when remote connections are provided - ssl_module

CCI|CCI-000068

CCI|CCI-000197

CCI|CCI-000213

CCI|CCI-000803

CCI|CCI-001166

CCI|CCI-001453

CCI|CCI-002448

CCI|CCI-002450

CCI|CCI-002452

CCI|CCI-002506

Rule-ID|SV-214278r881466_rule

STIG-ID|AS24-U2-000030

STIG-Legacy|SV-102851

STIG-Legacy|V-92763

Vuln-ID|V-214278

AS24-U2-000030 - The Apache web server must use encryption strength in accordance with the categorization of data hosted by the Apache web server when remote connections are provided - SSLProtocol

AS24-U2-000090 - The Apache web server must produce log records containing sufficient information to establish what type of events occurred - log_config_module

CCI|CCI-000130

Rule-ID|SV-214279r881469_rule

STIG-ID|AS24-U2-000090

STIG-Legacy|SV-102857

STIG-Legacy|V-92769

Vuln-ID|V-214279

AS24-U2-000090 - The Apache web server must produce log records containing sufficient information to establish what type of events occurred.

AS24-U2-000240 - The Apache web server must not perform user management for hosted applications.

CCI|CCI-000381

Rule-ID|SV-214280r879587_rule

STIG-ID|AS24-U2-000240

STIG-Legacy|SV-102859

STIG-Legacy|V-92771

Vuln-ID|V-214280

AS24-U2-000300 - The Apache web server must have Multipurpose Internet Mail Extensions (MIME) that invoke operating system shell programs disabled.

Rule-ID|SV-214281r881472_rule

STIG-ID|AS24-U2-000300

STIG-Legacy|SV-102861

STIG-Legacy|V-92773

Vuln-ID|V-214281

AS24-U2-000310 - The Apache web server must allow mappings to unused and vulnerable scripts to be removed.

Rule-ID|SV-214282r881475_rule

STIG-ID|AS24-U2-000310

STIG-Legacy|SV-102863

STIG-Legacy|V-92775

Vuln-ID|V-214282

AS24-U2-000320 - The Apache web server must have resource mappings set to disable the serving of certain file types.

Rule-ID|SV-214283r881478_rule

STIG-ID|AS24-U2-000320

STIG-Legacy|SV-102865

STIG-Legacy|V-92777

Vuln-ID|V-214283

AS24-U2-000350 - Users and scripts running on behalf of users must be contained to the document root or home directory tree of the Apache web server - Allow directives

Rule-ID|SV-214284r881481_rule

STIG-ID|AS24-U2-000350

STIG-Legacy|SV-102867

STIG-Legacy|V-92779

Vuln-ID|V-214284

AS24-U2-000350 - Users and scripts running on behalf of users must be contained to the document root or home directory tree of the Apache web server - Deny directives

AS24-U2-000350 - Users and scripts running on behalf of users must be contained to the document root or home directory tree of the Apache web server - Require all denied

AS24-U2-000360 - The Apache web server must be configured to use a specified IP address and port.

CCI|CCI-000382

Rule-ID|SV-214285r881484_rule

STIG-ID|AS24-U2-000360

STIG-Legacy|SV-102869

STIG-Legacy|V-92781

Vuln-ID|V-214285

AS24-U2-000380 - The Apache web server must perform RFC 5280-compliant certification path validation - ssl_module

CCI|CCI-000185

Rule-ID|SV-214286r881487_rule

STIG-ID|AS24-U2-000380

STIG-Legacy|SV-102873

STIG-Legacy|V-92785

Vuln-ID|V-214286

AS24-U2-000380 - The Apache web server must perform RFC 5280-compliant certification path validation - SSLVerifyClient

AS24-U2-000380 - The Apache web server must perform RFC 5280-compliant certification path validation - SSLVerifyDepth

AS24-U2-000390 - Only authenticated system administrators or the designated PKI Sponsor for the Apache web server must have access to the Apache web servers private key.

CCI|CCI-000186

Rule-ID|SV-214287r881490_rule

STIG-ID|AS24-U2-000390

STIG-Legacy|SV-102875

STIG-Legacy|V-92787

Vuln-ID|V-214287

AS24-U2-000390 - Only authenticated system administrators or the designated PKI Sponsor for the Apache web server must have access to the Apache web servers private key. - ssl_module

AS24-U2-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - Header HttpOnly Secure

CCI|CCI-001664

Rule-ID|SV-214288r881493_rule

STIG-ID|AS24-U2-000470

STIG-Legacy|SV-102883

STIG-Legacy|V-92795

Vuln-ID|V-214288

AS24-U2-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - Javascript setCookie

AS24-U2-000540 - The Apache web server must augment re-creation to a stable and known baseline.

CCI|CCI-001190

Rule-ID|SV-214289r879640_rule

STIG-ID|AS24-U2-000540

STIG-Legacy|SV-102885

STIG-Legacy|V-92797

Vuln-ID|V-214289

AS24-U2-000580 - The Apache web server document directory must be in a separate partition from the Apache web servers system files.

CCI|CCI-001084

Rule-ID|SV-214290r879643_rule

STIG-ID|AS24-U2-000580

STIG-Legacy|SV-102887

STIG-Legacy|V-92799

Vuln-ID|V-214290

AS24-U2-000590 - The Apache web server must be tuned to handle the operational requirements of the hosted application.

CCI|CCI-001094

CCI|CCI-002415

Rule-ID|SV-214291r881496_rule

STIG-ID|AS24-U2-000590

STIG-Legacy|SV-102889

STIG-Legacy|V-92801

Vuln-ID|V-214291

AS24-U2-000620 - The Apache web server must display a default hosted application web page, not a directory listing, when a requested web page cannot be found.

CCI|CCI-001312

Rule-ID|SV-214292r881498_rule

STIG-ID|AS24-U2-000620

STIG-Legacy|SV-102891

STIG-Legacy|V-92803

Vuln-ID|V-214292

AS24-U2-000630 - Warning and error messages displayed to clients must be modified to minimize the identity of the Apache web server, patches, loaded modules, and directory paths.

Rule-ID|SV-214293r881501_rule

STIG-ID|AS24-U2-000630

STIG-Legacy|SV-102893

STIG-Legacy|V-92805

Vuln-ID|V-214293

AS24-U2-000640 - Debugging and trace information used to diagnose the Apache web server must be disabled.

Rule-ID|SV-214294r881504_rule

STIG-ID|AS24-U2-000640

STIG-Legacy|SV-102895

STIG-Legacy|V-92807

Vuln-ID|V-214294

AS24-U2-000650 - The Apache web server must set an absolute timeout for sessions.

CCI|CCI-002391

Rule-ID|SV-214295r881507_rule

STIG-ID|AS24-U2-000650

STIG-Legacy|SV-102897

STIG-Legacy|V-92809

Vuln-ID|V-214295

AS24-U2-000660 - The Apache web server must set an inactive timeout for sessions - reqtimeout_module

Rule-ID|SV-214296r881509_rule

STIG-ID|AS24-U2-000660

STIG-Legacy|SV-102899

STIG-Legacy|V-92811

Vuln-ID|V-214296

AS24-U2-000660 - The Apache web server must set an inactive timeout for sessions - RequestReadTimeout

AS24-U2-000680 - The Apache web server must restrict inbound connections from nonsecure zones.

CCI|CCI-002344

Rule-ID|SV-214297r881511_rule

STIG-ID|AS24-U2-000680

STIG-Legacy|SV-102903

STIG-Legacy|V-92815

Vuln-ID|V-214297

AS24-U2-000700 - Non-privileged accounts on the hosting system must only access Apache web server security-relevant information and functions through a distinct administrative account.

CCI|CCI-002265

Rule-ID|SV-214298r879717_rule

STIG-ID|AS24-U2-000700

STIG-Legacy|SV-102905

STIG-Legacy|V-92817

Vuln-ID|V-214298

AS24-U2-000780 - The Apache web server application, libraries, and configuration files must only be accessible to privileged users.

CCI|CCI-001843

Rule-ID|SV-214299r879753_rule

STIG-ID|AS24-U2-000780

STIG-Legacy|SV-102907

STIG-Legacy|V-92819

Vuln-ID|V-214299

AS24-U2-000810 - The Apache web server must only accept client certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).

CCI|CCI-002500

Rule-ID|SV-214300r881513_rule

STIG-ID|AS24-U2-000810

STIG-Legacy|SV-102909

STIG-Legacy|V-92821

Vuln-ID|V-214300

AS24-U2-000870 - The Apache web server cookies, such as session cookies, sent to the client using SSL/TLS must not be compressed.

Rule-ID|SV-214301r881516_rule

STIG-ID|AS24-U2-000870

STIG-Legacy|SV-102919

STIG-Legacy|V-92831

Vuln-ID|V-214301

AS24-U2-000880 - Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data - Session on

Rule-ID|SV-214302r881518_rule

STIG-ID|AS24-U2-000880

STIG-Legacy|SV-102921

STIG-Legacy|V-92833

Vuln-ID|V-214302

AS24-U2-000880 - Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data - session_cookie_module

AS24-U2-000880 - Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data - SessionCookieName

AS24-U2-000890 - Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to force the encryption of cookies - Session On

Rule-ID|SV-214303r881521_rule

STIG-ID|AS24-U2-000890

STIG-Legacy|SV-102923

STIG-Legacy|V-92835

Detections

Analytics

DISA STIG Apache Server 2.4 Unix Site v2r3 Middleware

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous