DISA_STIG_Oracle_HTTP_Server_12.1.3_v2r1.audit from DISA Oracle HTTP Server 12.1.3 v2r1 STIG

OH12-1X-000001 - OHS must have the mpm property set to use the worker Multi-Processing Module (MPM) as the preferred means to limit the number of allowed simultaneous requests.

CAT|II

CCI|CCI-000054

Rule-ID|SV-221272r414501_rule

STIG-ID|OH12-1X-000001

STIG-Legacy|SV-77643

STIG-Legacy|V-63153

Vuln-ID|V-221272

OH12-1X-000002 - OHS must have the mpm_prefork_module directive disabled so as not conflict with the worker directive used to limit the number of allowed simultaneous requests.

Rule-ID|SV-221273r414504_rule

STIG-ID|OH12-1X-000002

STIG-Legacy|SV-78615

STIG-Legacy|V-64125

Vuln-ID|V-221273

OH12-1X-000003 - OHS must have the MaxClients directive defined to limit the number of allowed simultaneous requests.

Rule-ID|SV-221274r414507_rule

STIG-ID|OH12-1X-000003

STIG-Legacy|SV-78617

STIG-Legacy|V-64127

Vuln-ID|V-221274

OH12-1X-000004 - OHS must limit the number of threads within a worker process to limit the number of allowed simultaneous requests - ThreadLimit

Rule-ID|SV-221275r414510_rule

STIG-ID|OH12-1X-000004

STIG-Legacy|SV-78619

STIG-Legacy|V-64129

Vuln-ID|V-221275

OH12-1X-000004 - OHS must limit the number of threads within a worker process to limit the number of allowed simultaneous requests - ThreadsPerChild

OH12-1X-000005 - OHS must limit the number of worker processes to limit the number of allowed simultaneous requests.

Rule-ID|SV-221276r414513_rule

STIG-ID|OH12-1X-000005

STIG-Legacy|SV-78621

STIG-Legacy|V-64131

Vuln-ID|V-221276

OH12-1X-000007 - OHS must have the LoadModule ossl_module directive enabled to encrypt remote connections in accordance with the categorization of data hosted by the web server.

CAT|I

CCI|CCI-000068

Rule-ID|SV-221277r414516_rule

STIG-ID|OH12-1X-000007

STIG-Legacy|SV-78623

STIG-Legacy|V-64133

Vuln-ID|V-221277

OH12-1X-000008 - OHS must have the SSLFIPS directive enabled to encrypt remote connections in accordance with the categorization of data hosted by the web server.

Rule-ID|SV-221278r414519_rule

STIG-ID|OH12-1X-000008

STIG-Legacy|SV-78625

STIG-Legacy|V-64135

Vuln-ID|V-221278

OH12-1X-000009 - OHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to encrypt remote connections in accordance with the categorization of data hosted by the web server - SSLEngine

Rule-ID|SV-221279r414522_rule

STIG-ID|OH12-1X-000009

STIG-Legacy|SV-78627

STIG-Legacy|V-64137

Vuln-ID|V-221279

OH12-1X-000009 - OHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to encrypt remote connections in accordance with the categorization of data hosted by the web server - SSLProtocol

OH12-1X-000009 - OHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to encrypt remote connections in accordance with the categorization of data hosted by the web server - SSLWallet

OH12-1X-000010 - OHS must have the SSLCipherSuite directive enabled to encrypt remote connections in accordance with the categorization of data hosted by the web server.

Rule-ID|SV-221280r414525_rule

STIG-ID|OH12-1X-000010

STIG-Legacy|SV-78629

STIG-Legacy|V-64139

Vuln-ID|V-221280

OH12-1X-000011 - OHS must have the LoadModule ossl_module directive enabled to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server.

CCI|CCI-001453

Rule-ID|SV-221281r414528_rule

STIG-ID|OH12-1X-000011

STIG-Legacy|SV-78631

STIG-Legacy|V-64141

Vuln-ID|V-221281

OH12-1X-000012 - OHS must have the SSLFIPS directive enabled to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server.

Rule-ID|SV-221282r414531_rule

STIG-ID|OH12-1X-000012

STIG-Legacy|SV-78633

STIG-Legacy|V-64143

Vuln-ID|V-221282

OH12-1X-000013 - OHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server - SSLEngine

Rule-ID|SV-221283r414534_rule

STIG-ID|OH12-1X-000013

STIG-Legacy|SV-78635

STIG-Legacy|V-64145

Vuln-ID|V-221283

OH12-1X-000013 - OHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server - SSLProtocol

OH12-1X-000013 - OHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server - SSLWallet

OH12-1X-000014 - OHS must have the SSLCipherSuite directive enabled to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server.

Rule-ID|SV-221284r414537_rule

STIG-ID|OH12-1X-000014

STIG-Legacy|SV-78637

STIG-Legacy|V-64147

Vuln-ID|V-221284

OH12-1X-000015 - OHS must have the SecureProxy directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.

Rule-ID|SV-221285r414540_rule

STIG-ID|OH12-1X-000015

STIG-Legacy|SV-78639

STIG-Legacy|V-64149

Vuln-ID|V-221285

OH12-1X-000016 - OHS must have the WLSSLWallet directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.

Rule-ID|SV-221286r414543_rule

STIG-ID|OH12-1X-000016

STIG-Legacy|SV-78641

STIG-Legacy|V-64151

Vuln-ID|V-221286

OH12-1X-000017 - OHS must have the WebLogicSSLVersion directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.

Rule-ID|SV-221287r414546_rule

STIG-ID|OH12-1X-000017

STIG-Legacy|SV-78643

STIG-Legacy|V-64153

Vuln-ID|V-221287

OH12-1X-000018 - OHS must have the WLProxySSL directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.

Rule-ID|SV-221288r414549_rule

STIG-ID|OH12-1X-000018

STIG-Legacy|SV-78645

STIG-Legacy|V-64155

Vuln-ID|V-221288

OH12-1X-000019 - OHS must have the LoadModule log_config_module directive enabled to generate information to be used by external applications or entities to monitor and control remote access.

CCI|CCI-000067

Rule-ID|SV-221289r414552_rule

STIG-ID|OH12-1X-000019

STIG-Legacy|SV-78647

STIG-Legacy|V-64157

Vuln-ID|V-221289

OH12-1X-000020 - OHS must have the OraLogMode set to Oracle Diagnostic Logging text mode to generate information to be used by external applications or entities to monitor and control remote access.

Rule-ID|SV-221290r414555_rule

STIG-ID|OH12-1X-000020

STIG-Legacy|SV-78649

STIG-Legacy|V-64159

Vuln-ID|V-221290

OH12-1X-000021 - OHS must have a log directory location defined to generate information for use by external applications or entities to monitor and control remote access.

Rule-ID|SV-221291r414558_rule

STIG-ID|OH12-1X-000021

STIG-Legacy|SV-78651

STIG-Legacy|V-64161

Vuln-ID|V-221291

OH12-1X-000022 - OHS must have the OraLogSeverity directive defined to generate adequate information to be used by external applications or entities to monitor and control remote access.

Rule-ID|SV-221292r414561_rule

STIG-ID|OH12-1X-000022

STIG-Legacy|SV-78653

STIG-Legacy|V-64163

Vuln-ID|V-221292

OH12-1X-000023 - OHS must have the log rotation parameter set to allow generated information to be used by external applications or entities to monitor and control remote access.

Rule-ID|SV-221293r414564_rule

STIG-ID|OH12-1X-000023

STIG-Legacy|SV-78655

STIG-Legacy|V-64165

Vuln-ID|V-221293

OH12-1X-000024 - OHS must have a log format defined to generate adequate information to be used by external applications or entities to monitor and control remote access.

Rule-ID|SV-221294r414567_rule

STIG-ID|OH12-1X-000024

STIG-Legacy|SV-78657

STIG-Legacy|V-64167

Vuln-ID|V-221294

OH12-1X-000025 - OHS must have a SSL log format defined to allow generated information to be used by external applications or entities to monitor and control remote access in accordance with the categorization of data hosted by the web server.

Rule-ID|SV-221295r414570_rule

STIG-ID|OH12-1X-000025

STIG-Legacy|SV-78659

STIG-Legacy|V-64169

Vuln-ID|V-221295

OH12-1X-000026 - OHS must have a log file defined for each site/virtual host to capture information to be used by external applications or entities to monitor and control remote access.

Rule-ID|SV-221296r414573_rule

STIG-ID|OH12-1X-000026

STIG-Legacy|SV-78661

STIG-Legacy|V-64171

Vuln-ID|V-221296

OH12-1X-000030 - Remote access to OHS must follow access policy or work in conjunction with enterprise tools designed to enforce policy requirements.

CCI|CCI-002314

Rule-ID|SV-221297r414576_rule

STIG-ID|OH12-1X-000030

STIG-Legacy|SV-78983

STIG-Legacy|V-64493

Vuln-ID|V-221297

OH12-1X-000031 - OHS must have the Order, Allow, and Deny directives set within the Directory directives set to restrict inbound connections from nonsecure zones.

Rule-ID|SV-221298r414579_rule

STIG-ID|OH12-1X-000031

STIG-Legacy|SV-78985

STIG-Legacy|V-64495

Vuln-ID|V-221298

OH12-1X-000032 - OHS must have the Order, Allow, and Deny directives set within the Files directives set to restrict inbound connections from nonsecure zones.

Rule-ID|SV-221299r414582_rule

STIG-ID|OH12-1X-000032

STIG-Legacy|SV-78987

STIG-Legacy|V-64497

Vuln-ID|V-221299

OH12-1X-000033 - OHS must have the Order, Allow, and Deny directives set within the Location directives set to restrict inbound connections from nonsecure zones.

Rule-ID|SV-221300r414585_rule

STIG-ID|OH12-1X-000033

STIG-Legacy|SV-78989

STIG-Legacy|V-64499

Vuln-ID|V-221300

OH12-1X-000034 - OHS must provide the capability to immediately disconnect or disable remote access to the hosted applications.

CCI|CCI-002322

Rule-ID|SV-221301r414588_rule

STIG-ID|OH12-1X-000034

STIG-Legacy|SV-78991

STIG-Legacy|V-64501

Vuln-ID|V-221301

OH12-1X-000035 - Non-privileged accounts on the hosting system must only access OHS security-relevant information and functions through a distinct administrative account.

Detections

Analytics

DISA STIG Oracle HTTP Server 12.1.3 v2r1

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Added

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

Revision 1.0

Miscellaneous


Revision 1.4 May 16, 2023 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.3 Apr 12, 2023 Miscellaneous Metadata updated. Platform check updated. Added DISA_STIG_Oracle_HTTP_Server_12.1.3_v2r1.audit from DISA Oracle HTTP Server 12.1.3 v2r1 STIG
Revision 1.2 Mar 7, 2023 Miscellaneous Metadata updated. References updated.
Revision 1.1 Dec 7, 2022 Miscellaneous Variables updated.
Revision 1.0 May 27, 2022 Miscellaneous Metadata updated.