AS24-U1-000650 - The Apache web server must set an inactive timeout for sessions - reqtimeout_module

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after a set period of inactivity, the Apache web server can make certain that those sessions that are not closed through the user logging out of an application are eventually closed. mod_reqtimeout is an Apache module designed to shut down connections from clients taking too long to send their request, as seen in many attacks. This module provides a directive that allows Apache to close the connection if it senses that the client is not sending data quickly enough.

Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.

Solution

Determine the location of the 'HTTPD_ROOT' directory and the 'httpd.conf' file:

# httpd -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT='/etc/httpd'
-D SERVER_CONFIG_FILE='conf/httpd.conf'

Load the 'reqtimeout_module'.

Set the 'RequestReadTimeout' directive to specific values applicable to the website.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apache_Server_2-4_UNIX_Y22M01_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-12, CAT|II, CCI|CCI-002361, Rule-ID|SV-214258r612240_rule, STIG-ID|AS24-U1-000650, STIG-Legacy|SV-102793, STIG-Legacy|V-92705, Vuln-ID|V-214258

Plugin: Unix

Control ID: 6dcb4d85d260b34ddacbc7132a4ea8e06e41d5c217ac91c8deb3a026b5e5f4f4