The Apache web server must not be a proxy server.
An XCCDF Rule
Description
<VulnDiscussion>A web server should be primarily a web server or a proxy server but not both, for the same reasons that other multi-use servers are not recommended. Scanning for web servers that will also proxy requests into an otherwise protected network is a very common attack, making the attack anonymous.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-214241r881421_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Determine where the proxy modules are located by running the following command:
grep -rl "proxy_module" <'INSTALL PATH'>
Edit the file and comment out the following modules: