Home
Security Hardening
DISA STIG Apache Server 2.4 Windows Server V2R2

DISA STIG Apache Server 2.4 Windows Server V2R2

AS24-W1-000070 – The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
Details Log records can be generated from various components within the Apache web server (e.g., httpd, plug-ins to external backends,...
AS24-W1-000090 – The Apache web server must produce log records containing sufficient information to establish what type of events occurred.
Details Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of...
AS24-W1-000130 – An Apache web server, behind a load balancer or proxy server, must produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
Details Apache web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay...
AS24-W1-000160 – The Apache web server must use a logging mechanism that is configured to alert the (ISSO) and System Administrator (SA) in the event of a processing failure.
Details Reviewing log data allows an investigator to recreate the path of an attacker and to capture forensic data for...
AS24-W1-000180 – The Apache web server log files must only be accessible by privileged users.
Details Log data is essential in the investigation of events. If log data were to become compromised, competent forensic analysis...
AS24-W1-000200 – The log information from the Apache web server must be protected from unauthorized deletion and modification.
Details Log data is essential in the investigation of events. The accuracy of the information is always pertinent. Information that...
AS24-W1-000210 – The log data and records from the Apache web server must be backed up onto a different system or media.
Details Protection of log data includes ensuring log data is not accidentally lost or deleted. Backing up log records to...
AS24-W1-000240 – The Apache web server must not perform user management for hosted applications.
Details User management and authentication can be an essential part of any application hosted by the web server. Along with...
AS24-W1-000250 – The Apache web server must only contain services and functions necessary for operation – conf/extra/proxy-html.conf
Details A web server can provide many features, services, and processes. Some of these may be deemed unnecessary or too...
AS24-W1-000450 – The Apache web server must separate the hosted applications from hosted Apache web server management functionality.
Details The separation of user functionality from web server management can be accomplished by moving management functions to a separate...

Prev Next

DISA STIG Apache Server 2.4 Windows Server V2R2

AS24-W1-000070 – The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.

AS24-W1-000090 – The Apache web server must produce log records containing sufficient information to establish what type of events occurred.

AS24-W1-000130 – An Apache web server, behind a load balancer or proxy server, must produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.

AS24-W1-000160 – The Apache web server must use a logging mechanism that is configured to alert the (ISSO) and System Administrator (SA) in the event of a processing failure.

AS24-W1-000180 – The Apache web server log files must only be accessible by privileged users.

AS24-W1-000200 – The log information from the Apache web server must be protected from unauthorized deletion and modification.

AS24-W1-000210 – The log data and records from the Apache web server must be backed up onto a different system or media.

AS24-W1-000240 – The Apache web server must not perform user management for hosted applications.

AS24-W1-000250 – The Apache web server must only contain services and functions necessary for operation – conf/extra/proxy-html.conf

AS24-W1-000450 – The Apache web server must separate the hosted applications from hosted Apache web server management functionality.