OpenParable
Skip to content
← Back to skills

Cis Apache 5.2

DevOps & Security
cis-apache-5.2

Cis Apache 5.2 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure Options for the Web Root Directory Are Restricted

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Apache_HTTP_Server/CIS_Apache_HTTP_Server_2.2_Benchmark_v3.6.0/cis-apache-5.2/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-apache-5-2, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Ensure Options for the Web Root Directory Are Restricted

Description

The Apache Options directive allows for specific configuration of options, including execution of CGI, following symbolic links, server side includes, and content negotiation.

Refer to the Apache 2.2 documentation for details http://httpd.apache.org/docs/2.2/mod/core.html#options.

Rationale

The Options directive at the web root or document root level should be restricted to the minimal options required. A setting of None is highly recommended; however, at this level, content negotiation may be needed if multiple languages are supported. No other options should be enabled.

Impact

None documented

Audit Procedure

Perform the following to determine if the recommended state is implemented:

  1. Search the Apache configuration files (httpd.conf and any included configuration files) to find the document root <Directory> element.
  2. Ensure there is a single Options directive with the value of None or Multiviews (if multiviews are needed).

The following may be useful in extracting root directory elements from the Apache configuration for auditing:

perl -ne 'print if /^ *<Directory *\/i .. /<\/Directory/i'
$APACHE_PREFIX/conf/httpd.conf

Remediation

Perform the following to implement the recommended state:

  1. Search the Apache configuration files (httpd.conf and any included configuration files) to find the document root <Directory> element.
  2. Add or modify any existing Options directive to have a value of None or Multiviews, if multiviews are needed.
<Directory "/usr/local/apache2/htdocs">
   . . .
   Options None
   . . .
</Directory>

Default Value

The following is the default document root directory configuration:

<Directory "/usr/local/apache2/htdocs">
   . . .
   Options Indexes FollowSymLinks
   . . .
</Directory>

References

  1. https://httpd.apache.org/docs/2.2/mod/core.html#options

CIS Controls

Version 6

18 Application Software Security Application Software Security

Version 7

5.1 Establish Secure Configurations Maintain documented, standard security configuration standards for all authorized operating systems and software.

Profile

Level 1 | Scored