Detections
Analytics

2.1.6 Ensure web server services are not in use

Information

Web servers provide the ability to host web site content.

Unless there is an approved local site requirement to host web content, web server packages should be removed to reduce the potential attack surface. Web servers introduce listening network services, process untrusted remote input, and commonly expose additional attack surface through modules and plugins. If a web server package cannot be removed due to a package dependency, all associated services and sockets must be stopped and masked.

Solution

Run the following commands to stop apache2.socket, apache2.service and remove the apache2 package:

# systemctl stop apache2.socket apache2.service
# apt purge apache2

Run the following commands to stop nginx.service and remove the nginx package:

# systemctl stop nginx.service
# apt purge nginx

- OR -

- IF - a package is installed and is required for dependencies:

- IF - the apache2 package is required for dependencies:

Run the following commands to stop and mask apache2.socket and apache2.service :

# systemctl stop apache2.socket apache2.service
# systemctl mask apache2.socket apache2.service

- IF - the nginx package is required for dependencies:

Run the following commands to stop and mask nginx.service :

# systemctl stop nginx.service
# systemctl mask nginx.service

Note: Other web server packages may exist. If not required and authorized by local site policy, they should also be removed or masked.

Impact:

Removal of a web server package will prevent the system from hosting web services. If a web server package is required for a dependency, stopping and masking its service and socket prevents it from running while retaining the package. If the masked service is later legitimately required, it must be unmasked before it can be started.

See Also

https://workbench.cisecurity.org/benchmarks/26893

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 9032ce5334a2bea16bad7ea64010f86c75b6f20c92b15d366343a9cabdd49e43