Home
Security Hardening
DISA STIG Apache Server 2.4 Unix Site V2R2

DISA STIG Apache Server 2.4 Unix Site V2R2

AS24-U2-000810 – The Apache web server must only accept client certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).
Details Non-DoD approved PKIs have not been evaluated to ensure that they have security controls and identity vetting procedures in...
AS24-U2-000870 – The Apache web server cookies, such as session cookies, sent to the client using SSL/TLS must not be compressed.
Details A cookie is used when a web server needs to share data with the client’s browser. The data is...
AS24-U2-000880 – Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data – session_cookie_module
Details A cookie can be read by client-side scripts easily if cookie properties are not set properly. By allowing cookies...
AS24-U2-000880 – Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data – SessionCookieName
Details A cookie can be read by client-side scripts easily if cookie properties are not set properly. By allowing cookies...
AS24-U2-000880 – Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data – Session on
Details A cookie can be read by client-side scripts easily if cookie properties are not set properly. By allowing cookies...
AS24-U2-000890 – Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to force the encryption of cookies – session_cookie_module
Details Cookies can be sent to a client using TLS/SSL to encrypt the cookies, but TLS/SSL is not used by...
AS24-U2-000890 – Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to force the encryption of cookies – SessionCookieName
Details Cookies can be sent to a client using TLS/SSL to encrypt the cookies, but TLS/SSL is not used by...
AS24-U2-000890 – Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to force the encryption of cookies – Session On
Details Cookies can be sent to a client using TLS/SSL to encrypt the cookies, but TLS/SSL is not used by...
AS24-U2-000960 – The Apache web server must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.
Details Configuring the Apache web server to implement organization-wide security implementation guides and security checklists guarantees compliance with federal standards...
AS24-U2-000780 – The Apache web server application, libraries, and configuration files must only be accessible to privileged users.
Details The Apache web server can be modified through parameter modification, patch installation, upgrades to the Apache web server or...

DISA STIG Apache Server 2.4 Unix Site V2R2

AS24-U2-000810 – The Apache web server must only accept client certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).

AS24-U2-000870 – The Apache web server cookies, such as session cookies, sent to the client using SSL/TLS must not be compressed.

AS24-U2-000880 – Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data – session_cookie_module

AS24-U2-000880 – Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data – SessionCookieName

AS24-U2-000880 – Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data – Session on

AS24-U2-000890 – Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to force the encryption of cookies – session_cookie_module

AS24-U2-000890 – Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to force the encryption of cookies – SessionCookieName

AS24-U2-000890 – Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to force the encryption of cookies – Session On

AS24-U2-000960 – The Apache web server must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.

AS24-U2-000780 – The Apache web server application, libraries, and configuration files must only be accessible to privileged users.