The Apache web server must not be a proxy server.
An XCCDF Rule
Description
<VulnDiscussion>A web server should be primarily a web server or a proxy server but not both, for the same reasons that other multi-use servers are not recommended. Scanning for web servers that will also proxy requests into an otherwise protected network is a very common attack, making the attack anonymous.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-214320r879587_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Edit the <'INSTALL PATH'>\conf\httpd.conf file and remove the following modules:
proxy_module
proxy_ajp_module
proxy_balancer_module
proxy_ftp_module