Home
Security Hardening
DISA STIG Apache Server 2.4 Windows Server V2R2

DISA STIG Apache Server 2.4 Windows Server V2R2

AS24-W1-000530 – The Apache web server must generate unique session identifiers with definable entropy – SSLRandomSeed connect
Details Generating a session identifier (ID) that is not easily guessed through brute force is essential to deter several types...
AS24-W1-000300 – The Apache web server must have resource mappings set to disable the serving of certain file types.
Details Resource mapping is the process of tying a particular file type to a process in the web server that...
AS24-W1-000310 – The Apache web server must allow the mappings to unused and vulnerable scripts to be removed.
Details Scripts allow server-side processing on behalf of the hosted application user or as processes needed in the implementation of...
AS24-W1-000330 – The Apache web server must have Web Distributed Authoring (WebDAV) disabled.
Details A web server can be installed with functionality that, just by its nature, is not secure. WebDAV is an...
AS24-W1-000360 – The Apache web server must be configured to use a specified IP address and port – IP or Port Only
Details The web server must be configured to listen on a specified IP address and port. Without specifying an IP...
AS24-W1-000360 – The Apache web server must be configured to use a specified IP address and port – Zero IPs Only
Details The web server must be configured to listen on a specified IP address and port. Without specifying an IP...
AS24-W1-000370 – The Apache web server must encrypt passwords during transmission.
Details Data used to authenticate, especially passwords, needs to be protected at all times, and encryption is the standard method...
AS24-W1-000380 – The Apache web server must perform RFC 5280-compliant certification path validation.
Details A certificate’s certification path is the path from the end entity certificate to a trusted root certification authority (CA)....
AS24-W1-000430 – Apache web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.
Details As a rule, accounts on a web server are to be kept to a minimum. Only administrators, web managers,...
AS24-W1-000650 – The Apache web server must set an inactive timeout for completing the TLS handshake – RequestReadTimeout
Details Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to...

Prev Next

DISA STIG Apache Server 2.4 Windows Server V2R2

AS24-W1-000530 – The Apache web server must generate unique session identifiers with definable entropy – SSLRandomSeed connect

AS24-W1-000300 – The Apache web server must have resource mappings set to disable the serving of certain file types.

AS24-W1-000310 – The Apache web server must allow the mappings to unused and vulnerable scripts to be removed.

AS24-W1-000330 – The Apache web server must have Web Distributed Authoring (WebDAV) disabled.

AS24-W1-000360 – The Apache web server must be configured to use a specified IP address and port – IP or Port Only

AS24-W1-000360 – The Apache web server must be configured to use a specified IP address and port – Zero IPs Only

AS24-W1-000370 – The Apache web server must encrypt passwords during transmission.

AS24-W1-000380 – The Apache web server must perform RFC 5280-compliant certification path validation.

AS24-W1-000430 – Apache web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.

AS24-W1-000650 – The Apache web server must set an inactive timeout for completing the TLS handshake – RequestReadTimeout