OH12-1X-000169 - OHS must have resource mappings set to disable the serving of certain file types - Satisfy all

Information

Resource mapping is the process of tying a particular file type to a process in the web server that can serve that type of file to a requesting client and to identify which file types are not to be delivered to a client.

By not specifying which files can and which files cannot be served to a user, the web server could deliver to a user web server configuration files, log files, password files, etc.

The web server must only allow hosted application file types to be served to a user and all other types must be disabled.

Solution

1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/httpd.conf and every .conf file (e.g., ssl.conf) included in it with an editor.

2. Search for '<FilesMatch>' directives beyond the '<FilesMatch'^.ht'>' directive at the OHS server, virtual host, and directory configuration scopes.

3. Set the '<FilesMatch>' directive to ''^(?!.*.(gif|jpe?g|png|html?|js|css)).*$'' or other value appropriate for the server/site to prevent inappropriate file access, add the directive if it does not exist.

4a. Within the '<FilesMatch '^(?!.*.(gif|jpe?g|png|html?|js|css)).*$'>' directive, set the 'Order' directive to 'allow,deny', add the directive if it does not exist.
4b. Within the '<FilesMatch '^(?!.*.(gif|jpe?g|png|html?|js|css)).*$'>' directive, set the 'Deny' directive to 'from all', add the directive if it does not exist.
4c. Within the '<FilesMatch '^(?!.*.(gif|jpe?g|png|html?|js|css)).*$'>' directive, set the 'Satisfy' directive to 'All', add the directive if it does not exist.

Item Details

Audit Name: DISA STIG Oracle HTTP Server 12.1.3 v2r3

Category: CONFIGURATION MANAGEMENT

Plugin: Unix

Control ID: dd176efc310473fe215f6fe717baa668374ec2db13306728a4a315eab3bec649

Detections

Analytics

OH12-1X-000169 - OHS must have resource mappings set to disable the serving of certain file types - Satisfy all

Information

Solution

See Also

Item Details