cyberstrikeus Ensure All Web Content is Accessed via HTTPS
Description
All of the website content should be served via HTTPS rather than HTTP. A redirect from the HTTP website to the HTTPS content is often useful and is recommended, but all significant content should be accessed via HTTPS so that it is authenticated and encrypted.
Rationale
The usage of clear text HTTP prevents the client browser from authenticating the connection and ensuring the integrity of the website information. Without the HTTPS authentication, a client may be subjected to a variety of man-in-the-middle and spoofing attacks which would cause them to receive modified web content which could harm the organization's reputation. Through DNS attacks or malicious redirects, the client could arrive at a malicious website instead of the intended website. The malicious website could deliver malware, request credentials, or deliver false information.
Audit
Perform the following to determine if the recommended state is implemented:
• Gather the list of listening IP addresses from the Apache configuration files. The commands below may be used to extract the relevant IP addresses from the configuration files. The CONF_DIRS variable needs to be set to the list of directories that contain all of the Apache configuration files.
## Replace the following directory list with the appropriate list.
CONF_DIRS="/etc/httpd/conf /etc/httpd/conf.d /etc/httpd/conf_dir2 . . .
"
CONFS=$(find $CONF_DIRS -type f -name '*.conf' )
## Search for Listen directives that are not port :443 or https
IPS=$(egrep -ih '^\s*Listen ' $CONFS | egrep -iv '(:443\b)|https' | cut
-d' ' -f2)
• Gather the list of virtual host names from the Apache configuration files. The commands below can be used to extract the relevant virtual host names from the configuration files listed in $CONFS. The resulting list will include all virtual hosts not running on port :443. Although some listed virtual hosts may be TLS enabled, but on a non-standard port. Such websites will return an error rather than HTML content, as shown in the final steps.
## Get host names and ports of all of the virtual hosts
VHOSTS=$(egrep -iho '^\s*<VirtualHost .*>' $CONFS | egrep -io '\s+[A-
Z:.0-9]+\+$' | \
tr -d ' >')
• For each of the IP address and virtual hosts name, prefix the IP address or host name with the http:// protocol, and add the / slash as well.
URLS=$(for h in $LIPADDR $VHOSTS ; do echo "http://$h/"; done)
• Check to ensure each URL does not deliver significate web content via the HTTP protocol. The URL's may be manually entered in a browser for testing, or may be scripted with a command line web client such as curl, as shown below.
## For each of the URL's test with curl, and truncate the output to 300
characters
for u in $URLS ; do echo -e "\n\n\n==== $u ===="; curl -fSs $u | head -c
300 ; done
Any URLs which return significant HTML document content, rather than a redirect or an error are not compliant. Two compliant examples are shown; the first one has a redirect.
=== http://www.cisecurity.org/ ===
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="https://www.cisecurity.org/">here</a>.</p>
</body></html>
This compliant example below returns an error, due to using HTTP on a HTTPS website.
=== http://www.example.com:4430/ ===
curl: (22) The requested URL returned error: 400 Bad Request
Remediation
Perform the following to implement the recommended state:
Move the web content to a TLS enabled website, and add an HTTP Redirect directive to the Apache configuration file to redirect to the TLS enabled website similar to the example shown.
Redirect permanent / https://www.cisecurity.org/
Default Value
The following are the default values:
TLS is not enabled by default.
References
CIS Controls
Version 6
14.2 Encrypt All Sensitive Information Over Less-trusted Networks All communication of sensitive information over less-trusted networks should be encrypted. Whenever information flows over a network with a lower trust level, the information should be encrypted.
Version 7
14.4 Encrypt All Sensitive Information in Transit Encrypt all sensitive information in transit.
Profile
Level 1 | Scored Level 2 | Scored