New Apache Compliance Audit Policy
Tenable's research team has released a Nessus 3 audit policy file which can be used to audit the configuration of Apache web servers running on various UNIX platforms. The policy can be customized to your specific Apache distribution. It can audit many aspects of the httpd.conf file. For example, it has the ability to easily automate testing for which user the httpd process is running under, which ports it is bound to and what log format should be enabled. Since the actual configuration file is used, Nessus can perform this analysis even when the Apache server isn't running.
For completeness of report, Nessus's file content features are designed to ensure that if a certain setting is supposed to be set, it will pass if it is set, fail if it is not set and also provide a warning if the setting doesn't exist. For example, consider this section from the Apache .audit file:
<custom_item>
#System : "Linux"
type : FILE_CONTENT_CHECK
description : "Check if ServerSignature entry in httpd.conf is correctly set"
file : "httpd.conf"
search_locations : "/usr/local/apache/conf:/usr/local/etc/httpd:/etc/httpd"
regex : "ServerSignature *"
expect : "ServerSignature Off"
</custom_item>
This check looks into the httpd.conf and searches for the string "ServerSignature" followed by a word. If that string is found, it then tests for the complete string of "ServerSignature Off". The check will return the following Nessus severity levels based on the following conditions:
- hole - The "ServerSignature" value is present, but it is not set to "Off".
- warn - The "ServerSignature" value is not present, so there is no way to ensure we are compliant.
- info - The "ServerSignature" value is set to "Off".
This .audit file can be used with Nessus 3 scanners that have been subscribed to the Direct Feed, or that are being managed by a Security Center. The policy can be downloaded under the "Sample Application Audit Files" section from the Nessus 3 Agent-less Compliance Checks page.
Related Articles
Cybersecurity Snapshot: Prompt Injection and Data Disclosure Top OWASP’s List of Cyber Risks for GenAI LLM Apps
November 22, 2024Don’t miss OWASP’s update to its “Top 10 Risks for LLMs” list. Plus, the ranking of the most harmful software weaknesses is out. Meanwhile, critical infrastructure orgs have a new framework for using AI securely. And get the latest on the BianLian ransomware gang and on the challenges of protecting water and transportation systems against cyberattacks.
Active Directory Under Attack: Five Eyes Guidance Targets Crucial Security Gaps
November 21, 2024A landmark global report from cybersecurity agencies emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the first of our two-part series, we offer five steps you can take today to shore up your AD defenses.
Five Cyber Agencies Sound Alarm About Active Directory Attacks: Beyond the Basics
November 21, 2024A landmark global report emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the second of our two-part series, we take you beyond the basics to highlight three key areas to focus on.