WA120 A22 - Administrative users and groups that have access rights to the web server must be documented.


There are typically several individuals and groups that are involved in running a production web server. These accounts must be restricted to only those necessary to maintain web services, review the server's operation, and the operating system. By minimizing the amount of user and group accounts on a web server the total attack surface of the server is minimized. Additionally, if the required accounts aren't documented no known standard is created. Without a known standard the ability to identify required accounts is diminished, increasing the opportunity for error when such a standard is needed (i.e. COOP, IR, etc.).

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.


Document the administrative users and groups which have access rights to the web server in the web site SOP or in an equivalent document.

See Also


Item Details

References: CAT|III, Rule-ID|SV-32951r1_rule, STIG-ID|WA120_A22, Vuln-ID|V-2257

Plugin: Unix

Control ID: 97603d319e087c78946acd1ad1e8b1c2d44064c30aa07587d77871300d1c174e