Detections
Analytics

AS24-W1-000260 - The Apache web server must not be a proxy server.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

A web server should be primarily a web server or a proxy server but not both, for the same reasons that other multiuse servers are not recommended. Scanning for web servers that will also proxy requests into an otherwise protected network is a very common attack, making the attack anonymous.

Solution

Open the <'INSTALL PATH'>\conf\httpd.conf file with an editor and search for the following directive:

ProxyRequests

Set the directive to a value of 'off'.

Restart the Apache service.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apache_Server_2-4_Windows_Y25M04_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000381, Rule-ID|SV-214320r1051286_rule, STIG-ID|AS24-W1-000260, STIG-Legacy|SV-102461, STIG-Legacy|V-92373, Vuln-ID|V-214320

Plugin: Windows

Control ID: a867c6abd9b594f402772c260f1af195bd9a74cfbd25c298585ad8f5cce17ad3