Detections
Analytics

AS24-U1-000520 - The Apache web server must generate a session ID using as much of the character set as possible to reduce the risk of brute force.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Generating a session identifier (ID) that is not easily guessed through brute force is essential to deter several types of session attacks. By knowing the session ID, an attacker can hijack a user session that has already been user-authenticated by the hosted application. The attacker does not need to guess user identifiers and passwords or have a secure token since the user session has already been authenticated.

By generating session IDs that contain as much of the character set as possible, i.e., A-Z, a-z, and 0-9, the session ID becomes exponentially harder to guess.

Satisfies: SRG-APP-000223-WSR-000145, SRG-APP-000224-WSR-000135, SRG-APP-000224-WSR-000136, SRG-APP-000224-WSR-000138

Solution

Determine the location of the 'HTTPD_ROOT' directory and the 'httpd.conf' file:

# apachectl -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT='/etc/httpd'
-D SERVER_CONFIG_FILE='conf/httpd.conf'

Load the 'unique_id_module'.

Example: LoadModule unique_id_module modules/mod_unique_id.so

Restart Apache: apachectl restart

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apache_Server_2-4_Unix_Y24M01_STIG.zip

Item Details

References: CAT|I, CCI|CCI-001188, CCI|CCI-001664, Rule-ID|SV-214253r881438_rule, STIG-ID|AS24-U1-000520, STIG-Legacy|SV-102777, STIG-Legacy|V-92689, Vuln-ID|V-214253

Plugin: Unix

Control ID: df9c7685b985f1612ffdea1fca515fc87a991147409d19b773905fc742ecfa4a