WA00510 A22 - Web server status module must be disabled.

Information

The Apache mod_info module provides information on the server configuration via access to a /server-info URL location, while the mod_status module provides current server performance statistics. While having server configuration and status information available as a web page may be convenient, it is recommended that these modules not be enabled: Once mod_info is loaded into the server, its handler capability is available in per-directory .htaccess files and can leak sensitive information from the configuration directives of other Apache modules such as system paths, usernames/passwords, database names, etc. If mod_status is loaded into the server, its handler capability is available in all configuration files, including per-directory files (e.g., .htaccess) and may have security-related ramifications.

Solution

Edit the httpd.conf file and disable info_module and status_module.

See Also

https://iasecontent.disa.mil/stigs/zip/U_Apache_2-2_UNIX_V1R11_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b., CAT|II, Rule-ID|SV-33218r1_rule, STIG-ID|WA00510_A22, Vuln-ID|V-26294

Plugin: Unix

Control ID: 953c3af17b007636e2ff9e99004358606eda2e11d5e0eac3aa8fbdeb4ac25f26