An XCCDF Group - A logical subset of the XCCDF Benchmark
httpd
$ sudo zypper remove httpd
$ sudo systemctl mask --now httpd.service
$ sudo yum install httpd
core prefork http_core mod_so
$ httpd -l
/etc/httpd/conf/httpd.conf
chroot
ChrootDir
/chroot/apache
ChrootDir /chroot/apache
/etc/php.ini
# Do not expose PHP error messages to external users display_errors = Off # Enable safe mode safe_mode = On # Only allow access to executables in isolated directory safe_mode_exec_dir = php-required-executables-path # Limit external access to PHP environment safe_mode_allowed_env_vars = PHP_ # Restrict PHP information leakage expose_php = Off # Log all errors log_errors = On # Do not register globals for input data register_globals = Off # Minimize allowable PHP post size post_max_size = 1K # Ensure PHP redirects appropriately cgi.force_redirect = 0 # Disallow uploading unless necessary file_uploads = Off # Disallow treatment of file requests as fopen calls allow_url_fopen = Off # Enable SQL safe mode sql.safe_mode = On
http://httpd.apache.org/docs/
$ sudo service httpd configtest
LoadModule auth_basic_module modules/mod_auth_basic.so LoadModule authn_default_module modules/mod_authn_default.so LoadModule authz_host_module modules/mod_authz_host.so LoadModule authz_user_module modules/mod_authz_user.so LoadModule authz_groupfile_module modules/mod_authz_groupfile.so LoadModule authz_default_module modules/mod_authz_default.so LoadModule log_config_module modules/mod_log_config.so LoadModule logio_module modules/mod_logio.so LoadModule setenvif_module modules/mod_setenvif.so LoadModule mime_module modules/mod_mome.so LoadModule autoindex_module modules/mod_autoindex.so LoadModule negotiation_module modules/mod_negotiation.so LoadModule dir_module modules/mod_dir.so LoadModule alias_module modules/mod_alias.so
authn_file
authn_dbm
LoadModule authn_file_module modules/mod_authn_file.so LoadModule authn_dbm_module modules/mod_authn_dbm.so
authn_alias
authn_anon
authz_owner
authz_dbm
#LoadModule authn_alias_module modules/mod_authn_alias.so #LoadModule authn_anon_module modules/mod_authn_anon.so #LoadModule authz_owner_module modules/mod_authz_owner.so #LoadModule authz_dbm_module modules/mod_authz_dbm.so
Include
.conf
/etc/httpd/conf.d
#Include conf.d/*.conf
Include conf.d/ssl.conf
Include conf.d/php.conf
#LoadModule ext_filter_module modules/mod_ext_filter.so
#LoadModule expires_module modules/mod_expires.so
#LoadModule deflate_module modules/mod_deflate.so
#LoadModule headers_module modules/mod_headers.so
#LoadModule usertrack_module modules/mod_usertrack.so
#LoadModule vhost_alias_module modules/mod_vhost_alias.so
security
mod_security
mod_nss
mod_ssl
ServerTokens
ServerSignature
mod_cband mod_bwshare mod_limitipconn mod_evasive