Skip to content
Log In

APACHE 2.2 Server for Windows Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Web server and/or operating system information must be protected.

    The web server response header of an HTTP response can contain several fields of information including the requested HTML page. The information included in this response can be web server type and ...
    Rule Low Severity
    Show

  • WA155

    Group
    Show

  • Classified web servers will be afforded physical security commensurate with the classification of its content.

    When data of a classified nature is migrated to a web server, fundamental principles applicable to the safeguarding of classified material must be followed. A classified web server needs to be affo...
    Rule High Severity
    Show

  • WA230

    Group
    Show

  • WG355

    Group
    Show

  • WG385

    Group
    Show

  • WG145

    Group
    Show

  • The private web server must use an approved DoD certificate validation process.

    Without the use of a certificate validation process, the site is vulnerable to accepting certificates that have expired or have been revoked. This would allow unauthorized individuals access to the...
    Rule Medium Severity
    Show

  • WG237

    Group
    Show

  • Remote authors or content providers must have all files scanned for malware before uploading files to the Document Root directory.

    Remote web authors should not be able to upload files to the DocumentRoot directory structure without virus checking and checking for malicious or mobile code. A remote web user whose agency has a ...
    Rule Medium Severity
    Show

  • WA000-WWA052

    Group
    Show

  • The FollowSymLinks setting must be disabled.

    The Options directive configures the web server features that are available in particular directories. The FollowSymLinks option controls the ability of the server to follow symbolic links. A symbo...
    Rule Medium Severity
    Show

  • WA000-WWA054

    Group
    Show

  • Server side includes (SSIs) must run with execution capability disabled.

    The Options directive configures the web server features that are available in particular directories. The IncludesNOEXEC feature controls the ability of the server to utilize SSIs while disabling...
    Rule High Severity
    Show

  • WA000-WWA056

    Group
    Show

  • WA000-WWA058

    Group
    Show

  • Directory indexing must be disabled on directories not containing index files.

    Directory options directives are directives that can be applied to further restrict access to file and directories. If a URL which maps to a directory is requested, and there is no DirectoryIndex ...
    Rule Medium Severity
    Show

  • WA000-WWA060

    Group
    Show

  • WA000-WWA062

    Group
    Show

  • The HTTP request header fields must be limited.

    Buffer overflow attacks are carried out by a malicious attacker sending amounts of data that the web server cannot store in a given size buffer. The eventual overflow of this buffer can overwrite s...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules