AS24-W1-000260 - The Apache web server must not be a proxy server.

Information

A web server should be primarily a web server or a proxy server but not both, for the same reasons that other multi-use servers are not recommended. Scanning for web servers that will also proxy requests into an otherwise protected network is a very common attack, making the attack anonymous.

Solution

Edit the <'INSTALL PATH'>\conf\httpd.conf file and remove the following modules:

proxy_module
proxy_ajp_module
proxy_balancer_module
proxy_ftp_module
proxy_http_module
proxy_connect_module

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apache_Server_2-4_Windows_Y24M07_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7a., CAT|II, CCI|CCI-000381, Rule-ID|SV-214320r960963_rule, STIG-ID|AS24-W1-000260, STIG-Legacy|SV-102461, STIG-Legacy|V-92373, Vuln-ID|V-214320

Plugin: Windows

Control ID: e2627263e468b7dc2d426afcc1890ac68fde4e0743d881cede350698948ec33a