AS24-U2-000870 – The Apache web server cookies, such as session cookies, sent to the client using SSL/TLS must not be compressed.
Details A cookie is used when a web server needs to share data with the client’s browser. The data is...
- Home
- Security Hardening
- DISA STIG Apache Server 2.4 Unix Site V2R2 Middleware
DISA STIG Apache Server 2.4 Unix Site V2R2 Middleware
AS24-U2-000880 – Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data – session_cookie_module
Details A cookie can be read by client-side scripts easily if cookie properties are not set properly. By allowing cookies...AS24-U2-000880 – Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data – SessionCookieName
Details A cookie can be read by client-side scripts easily if cookie properties are not set properly. By allowing cookies...AS24-U2-000880 – Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data – Session on
Details A cookie can be read by client-side scripts easily if cookie properties are not set properly. By allowing cookies...AS24-U2-000890 – Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to force the encryption of cookies – session_cookie_module
Details Cookies can be sent to a client using TLS/SSL to encrypt the cookies, but TLS/SSL is not used by...AS24-U2-000890 – Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to force the encryption of cookies – SessionCookieName
Details Cookies can be sent to a client using TLS/SSL to encrypt the cookies, but TLS/SSL is not used by...AS24-U2-000890 – Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to force the encryption of cookies – Session On
Details Cookies can be sent to a client using TLS/SSL to encrypt the cookies, but TLS/SSL is not used by...AS24-U2-000700 – Non-privileged accounts on the hosting system must only access Apache web server security-relevant information and functions through a distinct administrative account.
Details By separating Apache web server security functions from non-privileged users, roles can be developed that can then be used...AS24-U2-000780 – The Apache web server application, libraries, and configuration files must only be accessible to privileged users.
Details The Apache web server can be modified through parameter modification, patch installation, upgrades to the Apache web server or...AS24-U2-000960 – The Apache web server must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.
Details Configuring the Apache web server to implement organization-wide security implementation guides and security checklists guarantees compliance with federal standards...