The OHS server root directory must not be on a network share.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-64685	OH12-1X-000224	SV-79175r1_rule		Medium

Description
Sharing of the web server directory where the executables are stored is a security risk when a web server is involved. Users that have access to the share may not be administrative users. These users could make changes to the web server without going through proper change control or the users could inadvertently delete executables that are key to the proper operation of the web server. Any unnecessary exposure increases the risk that someone could exploit that access and either compromises the web server or cause web server performance problems.

Description

Sharing of the web server directory where the executables are stored is a security risk when a web server is involved. Users that have access to the share may not be administrative users. These users could make changes to the web server without going through proper change control or the users could inadvertently delete executables that are key to the proper operation of the web server. Any unnecessary exposure increases the risk that someone could exploit that access and either compromises the web server or cause web server performance problems.

STIG	Date
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide	2019-01-04

Details

Check Text ( C-65427r1_chk )
1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS//httpd.conf. 2. Search for the "ServerRoot" directive at the OHS server configuration scope. 3. If the directive value is used as a network share (e.g., ps -ef \| grep nfs, ps -ef \| grep smb, etc.), this is a finding.

Fix Text (F-70615r1_fix)
1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS//httpd.conf. 2. Search for the "ServerRoot" directive at the OHS server configuration scope. 3. Remove the share that is associated with the directory specified as a value for the "ServerRoot" directive.