Cis Apache 1.2
DevOps & Securitycis-apache-1.2Cis Apache 1.2 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure the Server Is Not a Multi-Use System
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Apache_HTTP_Server/CIS_Apache_HTTP_Server_2.2_Benchmark_v3.6.0/cis-apache-1.2/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-apache-1-2, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
Ensure the Server Is Not a Multi-Use System
Description
A web server should function as only a web server, and it possible should not be mixed with other primary functions such as email, DNS, databases, or middleware. The number of services and daemons executing on the server should be limited to those necessary.
Rationale
Default server configurations often expose a wide variety of services. The more services exposed to an attacker, the more potential vectors an attacker has to exploit the server and therefore the higher the risk for the server. Just because a server can perform many services doesn't mean it is wise to do so. Maintaining a server for a single purpose increases the security of your application and system.
Impact
None documented
Audit Procedure
Leverage the package or services manager for your OS to list enabled services and compare them with the documented business needs of the server. On Red Hat systems, the following will produce the list of current services enabled:
chkconfig --list | grep ':on'
Remediation
Leverage the package or services manager for your OS to uninstall or disable all unneeded services. On Red Hat systems, the following will disable a given service:
chkconfig <servicename> off
Default Value
No default value specified - depends on OS installation type.
References
None documented
CIS Controls
Version 6
9.5 Operate Critical Services On Dedicated Hosts (i.e. DNS, Mail, Web, Database) Operate critical services on separate physical or logical host machines, such as DNS, file, mail, web, and database servers.
Version 7
2.10 Physically or Logically Segregate High Risk Applications Physically or logically segregated systems should be used to isolate and run software that is required for business operations but incur higher risk for the organization.
Profile
Level 1 | Not Scored Level 2 | Not Scored