OH12-1X-000001 - OHS must have the mpm property set to use the worker Multi-Processing Module (MPM) as the preferred means to limit the number of allowed simultaneous requests.

800-53|AC-10

CAT|II

CCI|CCI-000054

Rule-ID|SV-77643r1_rule

STIG-ID|OH12-1X-000001

Vuln-ID|V-63153

OH12-1X-000002 - OHS must have the mpm_prefork_module directive disabled so as not conflict with the worker directive used to limit the number of allowed simultaneous requests.

800-53|CM-7

Rule-ID|SV-78615r1_rule

STIG-ID|OH12-1X-000002

Vuln-ID|V-64125

OH12-1X-000003 - OHS must have the MaxClients directive defined to limit the number of allowed simultaneous requests.

Rule-ID|SV-78617r1_rule

STIG-ID|OH12-1X-000003

Vuln-ID|V-64127

OH12-1X-000004 - OHS must limit the number of threads within a worker process to limit the number of allowed simultaneous requests - ThreadLimit

Rule-ID|SV-78619r1_rule

STIG-ID|OH12-1X-000004

Vuln-ID|V-64129

OH12-1X-000004 - OHS must limit the number of threads within a worker process to limit the number of allowed simultaneous requests - ThreadsPerChild

OH12-1X-000005 - OHS must limit the number of worker processes to limit the number of allowed simultaneous requests.

Rule-ID|SV-78621r1_rule

STIG-ID|OH12-1X-000005

Vuln-ID|V-64131

OH12-1X-000007 - OHS must have the LoadModule ossl_module directive enabled to encrypt remote connections in accordance with the categorization of data hosted by the web server.

800-53|AC-17(2)

CAT|I

CCI|CCI-000068

Rule-ID|SV-78623r1_rule

STIG-ID|OH12-1X-000007

Vuln-ID|V-64133

OH12-1X-000008 - OHS must have the SSLFIPS directive enabled to encrypt remote connections in accordance with the categorization of data hosted by the web server.

Rule-ID|SV-78625r1_rule

STIG-ID|OH12-1X-000008

Vuln-ID|V-64135

OH12-1X-000009 - OHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to encrypt remote connections in accordance with the categorization of data hosted by the web server - SSLEngine

800-53|SC-8(2)

Rule-ID|SV-78627r2_rule

STIG-ID|OH12-1X-000009

Vuln-ID|V-64137

OH12-1X-000009 - OHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to encrypt remote connections in accordance with the categorization of data hosted by the web server - SSLProtocol

OH12-1X-000009 - OHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to encrypt remote connections in accordance with the categorization of data hosted by the web server - SSLWallet

OH12-1X-000010 - OHS must have the SSLCipherSuite directive enabled to encrypt remote connections in accordance with the categorization of data hosted by the web server.

Rule-ID|SV-78629r2_rule

STIG-ID|OH12-1X-000010

Vuln-ID|V-64139

OH12-1X-000011 - OHS must have the LoadModule ossl_module directive enabled to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server.

CCI|CCI-001453

Rule-ID|SV-78631r1_rule

STIG-ID|OH12-1X-000011

Vuln-ID|V-64141

OH12-1X-000012 - OHS must have the SSLFIPS directive enabled to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server.

Rule-ID|SV-78633r1_rule

STIG-ID|OH12-1X-000012

Vuln-ID|V-64143

OH12-1X-000013 - OHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server - SSLEngine

Rule-ID|SV-78635r2_rule

STIG-ID|OH12-1X-000013

Vuln-ID|V-64145

OH12-1X-000013 - OHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server - SSLProtocol

OH12-1X-000013 - OHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server - SSLWallet

OH12-1X-000014 - OHS must have the SSLCipherSuite directive enabled to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server.

Rule-ID|SV-78637r1_rule

STIG-ID|OH12-1X-000014

Vuln-ID|V-64147

OH12-1X-000015 - OHS must have the SecureProxy directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.

Rule-ID|SV-78639r1_rule

STIG-ID|OH12-1X-000015

Vuln-ID|V-64149

OH12-1X-000016 - OHS must have the WLSSLWallet directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.

Rule-ID|SV-78641r1_rule

STIG-ID|OH12-1X-000016

Vuln-ID|V-64151

OH12-1X-000017 - OHS must have the WebLogicSSLVersion directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.

Rule-ID|SV-78643r1_rule

STIG-ID|OH12-1X-000017

Vuln-ID|V-64153

OH12-1X-000018 - OHS must have the WLProxySSL directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.

Rule-ID|SV-78645r1_rule

STIG-ID|OH12-1X-000018

Vuln-ID|V-64155

OH12-1X-000019 - OHS must have the LoadModule log_config_module directive enabled to generate information to be used by external applications or entities to monitor and control remote access.

800-53|AU-12

CCI|CCI-000067

Rule-ID|SV-78647r1_rule

STIG-ID|OH12-1X-000019

Vuln-ID|V-64157

OH12-1X-000020 - OHS must have the OraLogMode set to Oracle Diagnostic Logging text mode to generate information to be used by external applications or entities to monitor and control remote access.

800-53|AC-17(1)

Rule-ID|SV-78649r1_rule

STIG-ID|OH12-1X-000020

Vuln-ID|V-64159

OH12-1X-000021 - OHS must have a log directory location defined to generate information for use by external applications or entities to monitor and control remote access.

800-53|AU-4(1)

Rule-ID|SV-78651r1_rule

STIG-ID|OH12-1X-000021

Vuln-ID|V-64161

OH12-1X-000022 - OHS must have the OraLogSeverity directive defined to generate adequate information to be used by external applications or entities to monitor and control remote access.

Rule-ID|SV-78653r1_rule

STIG-ID|OH12-1X-000022

Vuln-ID|V-64163

OH12-1X-000023 - OHS must have the log rotation parameter set to allow generated information to be used by external applications or entities to monitor and control remote access.

Rule-ID|SV-78655r1_rule

STIG-ID|OH12-1X-000023

Vuln-ID|V-64165

OH12-1X-000024 - OHS must have a log format defined to generate adequate information to be used by external applications or entities to monitor and control remote access.

Rule-ID|SV-78657r1_rule

STIG-ID|OH12-1X-000024

Vuln-ID|V-64167

OH12-1X-000025 - OHS must have a SSL log format defined to allow generated information to be used by external applications or entities to monitor and control remote access in accordance with the categorization of data hosted by the web server.

Rule-ID|SV-78659r1_rule

STIG-ID|OH12-1X-000025

Vuln-ID|V-64169

OH12-1X-000026 - OHS must have a log file defined for each site/virtual host to capture information to be used by external applications or entities to monitor and control remote access.

Rule-ID|SV-78661r1_rule

STIG-ID|OH12-1X-000026

Vuln-ID|V-64171

OH12-1X-000030 - Remote access to OHS must follow access policy or work in conjunction with enterprise tools designed to enforce policy requirements.

CCI|CCI-002314

Rule-ID|SV-78983r1_rule

STIG-ID|OH12-1X-000030

Vuln-ID|V-64493

OH12-1X-000031 - OHS must have the Order, Allow, and Deny directives set within the Directory directives set to restrict inbound connections from nonsecure zones.

Rule-ID|SV-78985r1_rule

STIG-ID|OH12-1X-000031

Vuln-ID|V-64495

OH12-1X-000032 - OHS must have the Order, Allow, and Deny directives set within the Files directives set to restrict inbound connections from nonsecure zones.

Rule-ID|SV-78987r1_rule

STIG-ID|OH12-1X-000032

Vuln-ID|V-64497

OH12-1X-000033 - OHS must have the Order, Allow, and Deny directives set within the Location directives set to restrict inbound connections from nonsecure zones.

Rule-ID|SV-78989r1_rule

STIG-ID|OH12-1X-000033

Vuln-ID|V-64499

OH12-1X-000034 - OHS must provide the capability to immediately disconnect or disable remote access to the hosted applications.

CCI|CCI-002322

Rule-ID|SV-78991r1_rule

STIG-ID|OH12-1X-000034

Vuln-ID|V-64501

OH12-1X-000035 - Non-privileged accounts on the hosting system must only access OHS security-relevant information and functions through a distinct administrative account.

800-53|AC-6(10)

CCI|CCI-002235

Rule-ID|SV-78993r1_rule

STIG-ID|OH12-1X-000035

Vuln-ID|V-64503

OH12-1X-000040 - OHS must have the client requests logging module loaded to generate log records for system startup and shutdown, system access, and system authentication logging.

CCI|CCI-000169

Rule-ID|SV-78663r1_rule

STIG-ID|OH12-1X-000040

Vuln-ID|V-64173

OH12-1X-000041 - OHS must have OraLogMode set to Oracle Diagnostic Logging text mode to generate log records for system startup and shutdown, system access, and system authentication logging.

Rule-ID|SV-78665r1_rule

STIG-ID|OH12-1X-000041

Vuln-ID|V-64175

OH12-1X-000042 - OHS must have a log directory location defined to generate log records for system startup and shutdown, system access, and system authentication logging.

Rule-ID|SV-78667r1_rule

STIG-ID|OH12-1X-000042

Vuln-ID|V-64177

OH12-1X-000043 - OHS must have a log level severity defined to generate adequate log records for system startup and shutdown, system access, and system authentication events.

Rule-ID|SV-78669r1_rule

STIG-ID|OH12-1X-000043

Vuln-ID|V-64179

OH12-1X-000044 - OHS must have the log rotation parameter set to allow for the generation log records for system startup and shutdown, system access, and system authentication events.

Rule-ID|SV-78671r1_rule

STIG-ID|OH12-1X-000044

Vuln-ID|V-64181

OH12-1X-000045 - OHS must have a log format defined to generate adequate logs by system startup and shutdown, system access, and system authentication events.

Rule-ID|SV-78673r1_rule

STIG-ID|OH12-1X-000045

Vuln-ID|V-64183

OH12-1X-000046 - OHS must have a SSL log format defined to generate adequate logs by system startup and shutdown, system access, and system authentication events.

Rule-ID|SV-78675r1_rule

STIG-ID|OH12-1X-000046

Vuln-ID|V-64185

OH12-1X-000047 - OHS must have a log file defined for each site/virtual host to capture logs generated by system startup and shutdown, system access, and system authentication events.

Rule-ID|SV-78677r1_rule

STIG-ID|OH12-1X-000047

Vuln-ID|V-64187

OH12-1X-000049 - OHS must capture, record, and log all content related to a user session.

CCI|CCI-001462

Rule-ID|SV-78679r1_rule

STIG-ID|OH12-1X-000049

Vuln-ID|V-64189

OH12-1X-000050 - OHS must have a log level severity defined to produce sufficient log records to establish what type of events occurred.

CCI|CCI-000130

Rule-ID|SV-78681r1_rule

STIG-ID|OH12-1X-000050

Vuln-ID|V-64191

OH12-1X-000051 - OHS must have a log format defined for log records generated to capture sufficient information to establish what type of events occurred.

Rule-ID|SV-78683r1_rule

STIG-ID|OH12-1X-000051

Vuln-ID|V-64193

OH12-1X-000052 - OHS must have a SSL log format defined for log records generated to capture sufficient information to establish what type of events occurred.

Rule-ID|SV-78685r1_rule

STIG-ID|OH12-1X-000052

Vuln-ID|V-64195

OH12-1X-000053 - OHS must have a log file defined for each site/virtual host to capture sufficient information to establish what type of events occurred.

Detections

Analytics

DISA STIG Oracle HTTP Server 12.1.3 v1r6

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.4

Functional Update

Informational Update

Miscellaneous

Revision 1.3

Functional Update

Informational Update

Miscellaneous

Revision 1.2

Functional Update

Informational Update

Miscellaneous

Revision 1.1

Functional Update

Informational Update

Miscellaneous


Revision 1.4 Jun 2, 2021 Functional Update OH12-1X-000208 - A production OHS Installation must prohibit the installation of a compiler. Informational Update OH12-1X-000208 - A production OHS Installation must prohibit the installation of a compiler. Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.3 Mar 23, 2021 Functional Update OH12-1X-000208 - A production OHS Installation must prohibit the installation of a compiler. Informational Update OH12-1X-000208 - A production OHS Installation must prohibit the installation of a compiler. Miscellaneous Metadata updated. References updated.
Revision 1.2 Sep 29, 2020 Functional Update OH12-1X-000208 - A production OHS Installation must prohibit the installation of a compiler. Informational Update OH12-1X-000208 - A production OHS Installation must prohibit the installation of a compiler. Miscellaneous References updated.
Revision 1.1 Jul 14, 2020 Functional Update OH12-1X-000208 - A production OHS Installation must prohibit the installation of a compiler. Informational Update OH12-1X-000208 - A production OHS Installation must prohibit the installation of a compiler. Miscellaneous Metadata updated.