UCF STIG Viewer Logo

APACHE SITE 2.0 for Windows


Date Finding Count (28)
2015-08-27 CAT I (High): 3 CAT II (Med): 21 CAT III (Low): 4
STIG Description
All directives specified in this STIG must be specifically set (i.e. the server is not allowed to revert to programmed defaults for these directives). Included files should be reviewed if they are used. Procedures for reviewing included files are included in the overview document. The use of .htaccess files are not authorized for use according to the STIG. However, if they are used, there are procedures for reviewing them in the overview document. The Web Policy STIG should be used in addition to the Apache Site and Server STIGs in order to do a comprehensive web server review.

Available Profiles

Findings (MAC III - Administrative Sensitive)

Finding ID Severity Title
V-2258 High The web client account access to the content and scripts directories must be limited to read and execute.
V-2249 High Web server administration must be performed over a secure path or at the local console.
V-13686 High Web Administrators must only use encrypted connections for Document Root directory uploads.
V-13694 Medium Public web servers must use TLS if authentication is required.
V-26279 Medium Error logging must be enabled.
V-2270 Medium Anonymous FTP user access to interactive scripts must be prohibited.
V-2254 Medium Only web sites that have been fully reviewed and tested must exist on a production web server.
V-2252 Medium Log file access must be restricted to System Administrators, Web Administrators or Auditors.
V-2250 Medium Logs of web server access and errors must be established and maintained.
V-6531 Medium Private web servers must require certificates issued from a DoD-authorized Certificate Authority.
V-13688 Medium Log file data must contain required data elements.
V-13689 Medium Access to the web server log files must be restricted to Administrators, the user assigned to run the web server software, Web Manager, and Auditors.
V-3333 Medium The web document (home) directory must be in a separate partition from the web server’s system files.
V-2272 Medium PERL scripts must use the TAINT option.
V-2228 Medium All interactive programs must be placed in a designated directory with appropriate permissions.
V-2263 Medium A private web server must have a valid DoD server certificate.
V-2262 Medium A private web server must utilize an approved TLS version.
V-2260 Medium A web site must not contain a robots.txt file.
V-2226 Medium Web content directories must not be anonymously shared.
V-2229 Medium Interactive scripts used on a web server must have proper access controls.
V-26280 Medium The sites error logs must log the correct format.
V-26281 Medium System logging must be enabled.
V-26282 Medium The LogLevel directive must be enabled.
V-2240 Medium The number of allowed simultaneous requests must be set.
V-15334 Low Web sites must utilize ports, protocols, and services according to PPSM guidelines.
V-2265 Low Java software on production web servers must be limited to class files and the JAVA virtual machine.
V-6373 Low The required DoD banner page must be displayed to authenticated users accessing a DoD private website.
V-2245 Low Each readable web document directory must contain either a default, home, index, or equivalent file.