Cis Apache 5.14
DevOps & Securitycis-apache-5.14Cis Apache 5.14 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure Browser Framing Is Restricted
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Apache_HTTP_Server/CIS_Apache_HTTP_Server_2.2_Benchmark_v3.6.0/cis-apache-5.14/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-apache-5-14, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
Ensure Browser Framing Is Restricted
Description
The Header directive allows server HTTP response headers to be added, replaced, or merged. Use the directive to add a server HTTP response header to tell browsers to restrict all the web pages from being framed by other web sites.
Rationale
Using iframes and regular web frames to embed malicious content along with expected web content has been a favored attack vector for attacking web clients for a long time. This can happen when the attacker lures the victim to a malicious web site, which uses frames to include the expected content from the legitimate site. The attack can also be performed via XSS (either reflected, DOM or stored XSS) to add the malicious content to the legitimate web site. To combat this vector, an HTTP Response header, X-Frame-Options, has been introduced that allows a server to specify whether a web page may be loaded in any frame (DENY) or only those frames that share the page's origin (SAMEORIGIN).
Audit Procedure
Perform the following steps to determine if the recommended state is implemented:
Ensure a Header directive for X-Frame-Options is present in the Apache configuration and has the condition always, an action of append, and a value of SAMEORIGIN, as shown below:
# grep -i X-Frame-Options $APACHE_PREFIX/conf/httpd.conf
Header always append X-Frame-Options SAMEORIGIN
Remediation
Perform the following to implement the recommended state:
Add or modify the Header directive for the X-Frame-Options header in the Apache configuration to have the condition always, an action of append, and a value of SAMEORIGIN, as shown below.
Header always append X-Frame-Options SAMEORIGIN
Default Value
The X-Frame-Options HTTP response header is not generated by default
References
- http://httpd.apache.org/docs/2.2/mod/mod_headers.html#header
- https://developer.mozilla.org/en/The_X-FRAME-OPTIONS_response_header
- http://blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx
CIS Controls
Version 6
18 Application Software Security Application Software Security
Version 7
5.1 Establish Secure Configurations Maintain documented, standard security configuration standards for all authorized operating systems and software.
Profile
Level 2 | Scored