Cis Apache24 3.3
DevOps & Securitycis-apache24-3.3Cis Apache24 3.3 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure the Apache User Account Is Locked
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Apache_HTTP_Server/CIS_Apache_HTTP_Server_2.4_Benchmark_v2.3.0/cis-apache24-3.3/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-apache24-3-3, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
3.3 Ensure the Apache User Account Is Locked
Profile Applicability
- Level 1
Description
The user account under which Apache runs should not have a valid password, but should be locked.
Rationale
As a defense-in-depth measure the Apache user account should be locked to prevent logins, and to prevent a user from su'ing to apache using the password. In general, there shouldn't be a need for anyone to have to su as apache, and when there is a need, then sudo should be used instead, which would not require the apache account password.
Audit
Ensure the apache account is locked using the following:
# passwd -S apache
The results will be similar to the following:
apache LK 2010-01-28 0 99999 7 -1 (Password locked.)
- or -
apache L 07/02/2012 -1 -1 -1 -1
Remediation
Use the passwd command to lock the apache account:
# passwd -l apache
Default Value
The default user is daemon and the account is typically locked.
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 5.3 Disable Dormant AccountsDelete or disable any dormant accounts after a period of 45 days of inactivity, where supported. | ● | ● | ● |
| v7 | 16.8 Disable Any Unassociated AccountsDisable any account that cannot be associated with a business process or business owner. | ● | ● | ● |
Profile
- Level 1