Detections
Analytics

2.1.18 Ensure web server services are not in use

Information

Web servers provide the ability to host web site content.

Unless there is a local site approved requirement to run a web server service on the system, web server packages should be removed to reduce the potential attack surface.

Solution

Run the following commands to stop httpd.socket and httpd.service and remove the httpd package:

# systemctl stop httpd.socket httpd.service
# dnf remove httpd

Run the following commands to stop nginx.service and remove the nginx package:

# systemctl stop nginx.service
# dnf remove nginx

- OR -

- IF - a package is installed and is required for dependencies:

- IF - the httpd package is required for dependencies:

Run the following commands to stop and mask httpd.socket and httpd.service :

# systemctl stop httpd.socket httpd.service
# systemctl mask httpd.socket httpd.service

- IF - the nginx package is required for dependencies:

Run the following commands to stop and mask nginx.service :

# systemctl stop nginx.service
# systemctl mask nginx.service

Note: Other web server packages may exist. If not required and authorized by local site policy, they should also be removed. If the package is required for a dependency, the service and socket should be stopped and masked.

Impact:

Removal of a web server's package, or changing the state of its service and/or socket, will prevent the server from hosting web services.

- IF - a web server package is required for a dependency, any related service or socket should be stopped and masked.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 87893b01911df0dc112d1900674bec18e9c5fc5935d9ef89b8e384d700ee8500