Detections
Analytics

AS24-W2-000440 - Anonymous user access to the Apache web server application directories must be prohibited.

Information

To properly monitor the changes to the web server and the hosted applications, logging must be enabled. Along with logging being enabled, each record must properly contain the changes made and the names of those who made the changes.

Allowing anonymous users the capability to change the web server or the hosted application will not generate proper log information that can then be used for forensic reporting in the case of a security issue. Allowing anonymous users to make changes will also grant change capabilities to anybody without forcing a user to authenticate before the changes can be made.

Satisfies: SRG-APP-000211-WSR-000031, SRG-APP-000380-WSR-000072

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Ensure non-administrators are not allowed access to the directory tree, the shell, or other operating system functions and utilities.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apache_Server_2-4_Windows_Y26M04_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CM-5(1), 800-53|SC-2, CAT|I, CCI|CCI-001082, CCI|CCI-001813, Rule-ID|SV-214373r1138073_rule, STIG-ID|AS24-W2-000440, STIG-Legacy|SV-102617, STIG-Legacy|V-92529, Vuln-ID|V-214373

Plugin: Windows

Control ID: 014b2ecb5b53ca1a50baed8e41045f033fb6de3b9daeafee1dcc76dcf0fbcbac