Skip to content

Commit 9662e8b

Browse files
k-hamzaaboe76
k-hamza
authored and
aboe76
committed
Feature (rhel7/httpd 2.4) : hardening apache and code refactoring (#251)
* Feature (rhel7/httpd 2.4) : hardening apache and code refactoring * remove hard returns * Add default Listen 80 in httpd.conf In case there no vhosts defined in pillar httpd will listen on port 80. Without this default it will not start * empty file autoindex.conf instead of deleting it * explicit hardening items and references from CIS * add #3.5 hardening rule * explain CIS recommendations categories * add dependencies before start service * add recommendation #7.1 Install mod_ssl * link in readme to hardening doc
1 parent 262399a commit 9662e8b

17 files changed

+1512
-5
lines changed

‎Hardening.md

+105
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
# Hardening list
2+
3+
This formula enforce security recommandations from [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks/) website
4+
5+
From ***CIS_Apache_HTTP_Server_2.4_Benchmark_v1.4.pdf*** document
6+
7+
> A scoring status indicates whether compliance with the given recommendation impacts the assessed target's benchmark score.
8+
9+
> Items in [*level 2*] profile exhibit one or more of the following characteristics:
10+
> - are intended for environments or use cases where security is paramount
11+
> - acts as defense in depth measure
12+
> - may negatively inhibit the utility or performance of the technology
13+
14+
In this formula we focus on (**Scored**) [*level* ***1***] items
15+
16+
## List of all items with their CIS references
17+
18+
## 2. Minimize Apache Modules
19+
- [ ] 2.1 Enable Only Necessary Authentication and Authorization Modules (Not Scored)
20+
- [X] 2.2 Enable the Log Config Module (**Scored**)
21+
- [X] 2.3 Disable WebDAV Modules (**Scored**)
22+
- [X] 2.4 Disable Status Module (**Scored**)
23+
- [X] 2.5 Disable Autoindex Module (**Scored**)
24+
- [ ] 2.6 Disable Proxy Modules (**Scored**)
25+
- [X] 2.7 Disable User Directories Modules (**Scored**)
26+
- [X] 2.8 Disable Info Module (**Scored**)
27+
## 3. Principles, Permissions, and Ownership
28+
- [X] 3.1 Run the Apache Web Server as a non-root user (**Scored**)
29+
- [X] 3.2 Give the Apache User Account an Invalid Shell (**Scored**)
30+
- [ ] 3.3 Lock the Apache User Account (**Scored**)
31+
- [X] 3.4 Set Ownership on Apache Directories and Files (**Scored**)
32+
- [X] 3.5 Set Group Id on Apache Directories and Files (**Scored**)
33+
- [ ] 3.6 Restrict Other Write Access on Apache Directories and Files (**Scored**)
34+
- [X] 3.7 Secure Core Dump Directory (**Scored**)
35+
- [ ] 3.8 Secure the Lock File (**Scored**)
36+
- [X] 3.9 Secure the Pid File (**Scored**)
37+
- [X] 3.10 Secure the ScoreBoard File (**Scored**)
38+
- [X] 3.11 Restrict Group Write Access for the Apache Directories and Files (**Scored**)
39+
- [X] 3.12 Restrict Group Write Access for the Document Root Directories and Files (**Scored**)
40+
## 4. Apache Access Control
41+
- [X] 4.1 Deny Access to OS Root Directory (**Scored**)
42+
- [ ] 4.2 Allow Appropriate Access to Web Content (Not Scored)
43+
- [X] 4.3 Restrict Override for the OS Root Directory (**Scored**)
44+
- [X] 4.4 Restrict Override for All Directories (**Scored**)
45+
## 5. Minimize Features, Content and Options
46+
- [X] 5.1 Restrict Options for the OS Root Directory (**Scored**)
47+
- [X] 5.2 Restrict Options for the Web Root Directory (**Scored**)
48+
- [X] 5.3 Minimize Options for Other Directories (**Scored**)
49+
- [X] 5.4 Remove Default HTML Content (**Scored**)
50+
- [X] 5.5 Remove Default CGI Content printenv (**Scored**)
51+
- [X] 5.6 Remove Default CGI Content test-cgi (**Scored**)
52+
- [X] 5.7 Limit HTTP Request Methods (**Scored**)
53+
- [X] 5.8 Disable HTTP TRACE Method (**Scored**)
54+
- [X] 5.9 Restrict HTTP Protocol Versions (**Scored**)
55+
- [X] 5.10 Restrict Access to .ht* files (**Scored**)
56+
- [ ] 5.11 Restrict File Extensions [*level 2*] (**Scored**)
57+
- [ ] 5.12 Deny IP Address Based Requests [*level 2*] (**Scored**)
58+
- [ ] 5.13 Restrict Listen Directive [*level 2*] (**Scored**)
59+
- [ ] 5.14 Restrict Browser Frame Options [*level 2*] (**Scored**)
60+
## 6. Operations - Logging, Monitoring and Maintenance
61+
- [X] 6.1 Configure the Error Log (**Scored**)
62+
- [ ] 6.2 Configure a Syslog Facility for Error Logging [*level 2*] (**Scored**)
63+
- [X] 6.3 Configure the Access Log (**Scored**)
64+
- [X] 6.4 Log Storage and Rotation (**Scored**)
65+
- [ ] 6.5 Apply Applicable Patches (**Scored**)
66+
- [ ] 6.6 Install and Enable ModSecurity [*level 2*] (**Scored**)
67+
- [ ] 6.7 Install and Enable OWASP ModSecurity Core Rule Set [*level 2*] (**Scored**)
68+
## 7. SSL/TLS Configuration
69+
- [X] 7.1 Install mod_ssl and/or mod_nss (**Scored**)
70+
- [ ] 7.2 Install a Valid Trusted Certificate (**Scored**)
71+
- [ ] 7.3 Protect the Server's Private Key (**Scored**)
72+
- [X] 7.4 Disable the SSL v3.0 Protocol (**Scored**)
73+
- [ ] 7.5 Restrict Weak SSL/TLS Ciphers (**Scored**)
74+
- [X] 7.6 Disable SSL Insecure Renegotiation (**Scored**)
75+
- [X] 7.7 Ensure SSL Compression is not Enabled (**Scored**)
76+
- [ ] 7.8 Restrict Medium Strength SSL/TLS Ciphers (**Scored**)
77+
- [ ] 7.9 Disable the TLS v1.0 Protocol [*level 2*] (**Scored**)
78+
- [ ] 7.10 Enable OCSP Stapling [*level 2*] (**Scored**)
79+
- [ ] 7.11 Enable HTTP Strict Transport Security [*level 2*] (**Scored**)
80+
## 8. Information Leakage
81+
- [X] 8.1 Set ServerToken to 'Prod' (**Scored**)
82+
- [X] 8.2 Set ServerSignature to 'Off' (**Scored**)
83+
- [ ] 8.3 Information Leakage via Default Apache Content [*level 2*] (**Scored**)
84+
- [ ] 8.4 Information Leakage via ETag [*level 2*] (**Scored**)
85+
## 9. Denial of Service Mitigations
86+
- [X] 9.1 Set TimeOut to 10 or less (**Scored**)
87+
- [X] 9.2 Set the KeepAlive directive to On (**Scored**)
88+
- [X] 9.3 Set MaxKeepAliveRequests to 100 or greater (**Scored**)
89+
- [X] 9.4 Set KeepAliveTimeout Low to Mitigate Denial of Service (**Scored**)
90+
- [X] 9.5 Set Timeout Limits for Request Headers (**Scored**)
91+
- [X] 9.6 Set Timeout Limits for the Request Body (**Scored**)
92+
## 10. Request Limits
93+
- [ ] 10.1 Set the LimitRequestLine directive to 512 or less [*level 2*] (**Scored**)
94+
- [ ] 10.2 Set the LimitRequestFields directive to 100 or less [*level 2*] (**Scored**)
95+
- [ ] 10.3 Set the LimitRequestFieldsize directive to 1024 or less [*level 2*] (**Scored**)
96+
- [ ] 10.4 Set the LimitRequestBody directive to 102400 or less [*level 2*] (**Scored**)
97+
## 11. Enable SELinux to Restrict Apache Processes
98+
- [ ] 11.1 Enable SELinux in Enforcing Mode [*level 2*] (**Scored**)
99+
- [ ] 11.2 Run Apache Processes in the httpd_t Confined Context [*level 2*] (**Scored**)
100+
- [ ] 11.3 Ensure the httpd_t Type is Not in Permissive Mode [*level 2*] (**Scored**)
101+
- [ ] 11.4 Ensure Only the Necessary SELinux Booleans are Enabled [*level 2*] (Not Scored)
102+
## 12. Enable AppArmor to Restrict Apache Processes
103+
- [ ] 12.1 Enable the AppArmor Framework [*level 2*] (**Scored**)
104+
- [ ] 12.2 Customize the Apache AppArmor Profile [*level 2*] (Not Scored)
105+
- [ ] 12.3 Ensure Apache AppArmor Profile is in Enforce Mode [*level 2*] (**Scored**)

‎README-ng.rst

+149
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
======
2+
apache
3+
======
4+
5+
Formulas to set up and configure the Apache HTTP server.
6+
7+
This Formula uses the concepts of ``directive`` and ``container`` in pillars
8+
9+
* ``directive`` is an httpd directive https://httpd.apache.org/docs/2.4/en/mod/directives.html
10+
* ``container`` is what described the `configuration sections` https://httpd.apache.org/docs/2.4/en/sections.html
11+
12+
see examples below for more explanation
13+
14+
Also it includes and enforce some hardening rules to prevent security issues
15+
16+
See `<Hardening.md>`_ and `<apache/hardening-values.yaml>`_.
17+
18+
.. note::
19+
20+
See the full `Salt Formulas installation and usage instructions
21+
<http://docs.saltstack.com/en/latest/topics/development/conventions/formulas.html>`_.
22+
23+
Available states
24+
================
25+
26+
.. contents::
27+
:local:
28+
29+
``apache``
30+
----------
31+
32+
Installs the Apache package and starts the service.
33+
34+
``apache.config-ng``
35+
-----------------
36+
37+
Configures apache server.
38+
39+
The configuration is done by merging the pillar content with defaults
40+
present in the state `<apache/defaults/RedHat/defaults-apache-2.4.yaml>`_
41+
42+
.. code:: yaml
43+
44+
apache:
45+
server_apache_config:
46+
directives:
47+
- Timeout: 5
48+
containers:
49+
IfModule:
50+
-
51+
item: 'mime_module'
52+
directives:
53+
- AddType: 'application/x-font-ttf ttc ttf'
54+
- AddType: 'application/x-font-opentype otf'
55+
- AddType: 'application/x-font-woff woff2'
56+
57+
58+
``apache.modules-ng``
59+
------------------
60+
61+
Enables and disables Apache modules.
62+
63+
``apache.vhosts.vhost-ng``
64+
--------------------------
65+
66+
Configures Apache name-based virtual hosts and creates virtual host directories using data from Pillar.
67+
68+
All necessary data must be provided in the pillar
69+
70+
Exceptions are :
71+
72+
* ``CustomLog`` default is ``/path/apache/log/ServerName-access.log combined``
73+
74+
* if ``Logformat`` is defined in pillar, ``CustomLog`` is enforced to ``/path/apache/log/ServerName-access.log Logformat``
75+
76+
* ``ErrorLog`` is enforced to ``/path/apache/log/ServerName-error.log``
77+
78+
Example Pillar:
79+
80+
Create two vhosts ``example.com.conf`` and ``test.example.com.conf``
81+
82+
.. code:: yaml
83+
84+
apache:
85+
VirtualHost:
86+
example.com: # <-- this is an id decalaration used in salt and default ServerName
87+
item: '*:80'
88+
directives:
89+
- RewriteEngine: 'on'
90+
- Header: 'set Access-Control-Allow-Methods GET,PUT,POST,DELETE,OPTIONS'
91+
containers:
92+
Location:
93+
item: '/test.html'
94+
directives:
95+
- Require: 'all granted'
96+
site_id_declaration:
97+
item: '10.10.1.1:8080'
98+
directives:
99+
- ServerName: 'test.example.com'
100+
- LogFormat: '"%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %{ms}T"'
101+
102+
Files produced by these pillars :
103+
104+
``example.com.conf``
105+
106+
.. code:: bash
107+
108+
<VirtualHost *:80>
109+
ServerName example.com
110+
CustomLog /var/log/httpd/example.com-access.log combined
111+
ErrorLog /var/log/httpd/example.com-error.log
112+
RewriteEngine on
113+
Header set Access-Control-Allow-Methods GET,PUT,POST,DELETE,OPTIONS
114+
<Location /test.html>
115+
Require all granted
116+
</Location>
117+
</VirtualHost>
118+
119+
120+
``test.example.com.conf``
121+
122+
.. code:: bash
123+
124+
<VirtualHost 10.10.1.1:8080>
125+
ServerName test.example.com
126+
CustomLog /var/log/httpd/test.example.com-access.log "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %{ms}T"
127+
ErrorLog /var/log/httpd/test.example.com-error.log
128+
</VirtualHost>
129+
130+
131+
132+
this will delete ``test.example.com.conf``
133+
134+
.. code:: yaml
135+
136+
apache:
137+
VirtualHost:
138+
test.example.com:
139+
item: '10.10.1.1:8080'
140+
absent: True # <-- delete test.example.com.conf
141+
directives:
142+
- ServerName: 'test.example.com'
143+
144+
145+
146+
``apache.uninstall``
147+
----------
148+
149+
Stops the Apache service and uninstalls the package.

‎README.rst

+5-2
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22
apache
33
======
44

5+
6+
.. note:: See `<README-ng.rst>`_ for new gen of the state.
7+
58
Formulas to set up and configure the Apache HTTP server.
69

710
.. note::
@@ -185,14 +188,14 @@ Example Pillar:
185188
186189
When using the provided templates, one can use a space separated list
187190
of interfaces to bind to. For example, to bind both IPv4 and IPv6:
188-
191+
189192
.. code:: yaml
190193
191194
apache:
192195
sites:
193196
example.com:
194197
interface: '1.2.3.4 [2001:abc:def:100::3]'
195-
198+
196199
``apache.manage_security``
197200
--------------------------
198201

0 commit comments

Comments
 (0)