AS24-U1-000260 - The Apache web server must not be a proxy server - ProxyRequest

Information

A web server should be primarily a web server or a proxy server but not both, for the same reasons that other multi-use servers are not recommended. Scanning for web servers that will also proxy requests into an otherwise protected network is a very common attack, making the attack anonymous.

Solution

Determine where the proxy modules are located by running the following command:

grep -rl 'proxy_module' <'INSTALL PATH'>

Edit the file and comment out the following modules:

proxy_module
proxy_ajp_module
proxy_balancer_module
proxy_ftp_module
proxy_http_module
proxy_connect_module
Comment out the ProxyRequext directive in the httpd.conf file.

Restart Apache: apachectl restart

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apache_Server_2-4_Unix_Y24M07_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7a., CAT|II, CCI|CCI-000381, Rule-ID|SV-214241r960963_rule, STIG-ID|AS24-U1-000260, STIG-Legacy|SV-102731, STIG-Legacy|V-92643, Vuln-ID|V-214241

Plugin: Unix

Control ID: 6c7343d129e33f82077a4b83fcc9638f45406e80e768856461c33d21df78790e