cyberstrikeus Ensure Options for the OS Root Directory Are Restricted
Description
The Apache Options directive allows for specific configuration of options, including execution of CGI, following symbolic links, server side includes, and content negotiation.
Refer to the Apache 2.2 documentation for details: http://httpd.apache.org/docs/2.2/mod/core.html#options.
Rationale
The Options directive for the root OS level is used to create a default minimal options policy that allows only the minimal options at the root directory level. Then for specific web sites or portions of the web site, options may be enabled as needed and appropriate. No options should be enabled and the value for the Options directive should be None.
Impact
None documented
Audit Procedure
Perform the following to determine if the recommended state is implemented:
- Search the Apache configuration files (
httpd.confand any included configuration files) to find a root<Directory>element. - Ensure there is a single
Optionsdirective with the value of None.
The following may be useful for extracting root directory elements from the Apache configuration for auditing:
perl -ne 'print if /^ *<Directory *\/i .. /<\/Directory/i'
$APACHE_PREFIX/conf/httpd.conf
Remediation
Perform the following to implement the recommended state:
- Search the Apache configuration files (
httpd.confand any included configuration files) to find a root<Directory>element. - Add a single
Optionsdirective if there is none. - Set the value for
Optionsto None.
<Directory />
. . .
Options None
. . .
</Directory>
Default Value
The following is the default root directory configuration:
<Directory />
Options FollowSymlinks
. . .
</Directory>
References
CIS Controls
Version 6
18 Application Software Security Application Software Security
Version 7
5.1 Establish Secure Configurations Maintain documented, standard security configuration standards for all authorized operating systems and software.
Profile
Level 1 | Scored