Cis Apache 2.1
DevOps & Securitycis-apache-2.1Cis Apache 2.1 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure Only Necessary Authentication and Authorization Modules Are Enabled
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Apache_HTTP_Server/CIS_Apache_HTTP_Server_2.2_Benchmark_v3.6.0/cis-apache-2.1/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-apache-2-1, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
Ensure Only Necessary Authentication and Authorization Modules Are Enabled
Description
The Apache 2.2 modules for authentication and authorization have been refactored to provide finer granularity and more consistent and logical names, and to simplify configuration. The authn_* modules provide authentication, while the authz_* modules provide authorization. Apache provides two types of authentication: basic and digest. Enable only the modules that are required.
Rationale
Authentication and authorization are the front doors to the protected information in your web site. Most installations only need a small subset of the modules available. By minimizing the enabled modules to those that are actually used, we reduce the number of "doors" and therefore reduce the attack surface of the web site. Likewise, having fewer modules means less software that could have vulnerabilities.
Impact
None documented
Audit Procedure
- Use the
httpd -Moption as root to check which auth* modules are loaded.
# httpd -M | egrep 'auth.'
- Use the
httpd -Moption as root to check for any LDAP modules which don't follow the same naming convention.
# httpd -M | egrep 'ldap'
The above commands should generate a Syntax OK message to stderr, in addition to a list of modules installed to stdout. If the Syntax OK message is missing, then there was most likely an error in parsing the configuration files.
Remediation
Consult Apache module documentation for descriptions of each module in order to determine the necessary modules for the specific installation. The unnecessary static compiled modules are disabled through compile time configuration options. The dynamically loaded modules are disabled by commenting out or removing the LoadModule directive from the Apache configuration files (typically httpd.conf). Some modules may be separate packages and may be removed.
Default Value
The following are the modules statically loaded for a default source build:
authn_file_module(static)authn_default_module(static)authz_host_module(static)authz_groupfile_module(static)authz_user_module(static)authz_default_module(static)auth_basic_module(static)
References
- https://httpd.apache.org/docs/2.2/howto/auth.html
- https://httpd.apache.org/docs/2.2/mod/
- https://httpd.apache.org/docs/2.2/programs/configure.html
CIS Controls
Version 6
16 Account Monitoring and Control Account Monitoring and Control
Version 7
16.1 Maintain an Inventory of Authentication Systems Maintain an inventory of each of the organization's authentication systems, including those located onsite or at a remote service provider.
Profile
Level 1 | Not Scored Level 2 | Not Scored