OHS hosted web sites must utilize ports, protocols, and services according to PPSM guidelines.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-64703	OH12-1X-000233	SV-79193r1_rule		Low

Description
Failure to comply with DoD ports, protocols, and services (PPS) requirements can result in compromise of enclave boundary protections and/or functionality of the automated information system (AIS). The ISSM will ensure web servers are configured to use only authorized PPS in accordance with the Network Infrastructure STIG, DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM), and the associated Ports, Protocols, and Services (PPS) Assurance Category Assignments List.

Description

Failure to comply with DoD ports, protocols, and services (PPS) requirements can result in compromise of enclave boundary protections and/or functionality of the automated information system (AIS). The ISSM will ensure web servers are configured to use only authorized PPS in accordance with the Network Infrastructure STIG, DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM), and the associated Ports, Protocols, and Services (PPS) Assurance Category Assignments List.

STIG	Date
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide	2020-06-12

Details

Check Text ( C-65445r1_chk )
1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS//httpd.conf and every .conf file (e.g., ssl.conf) included in it with an editor. 2. Search for the "Listen" directive at the OHS server configuration scope. 3. If the "Listen" directive port specified is not "80" or "443", this is a finding.

Fix Text (F-70633r1_fix)
1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS//httpd.conf and every .conf file (e.g., ssl.conf) included in it with an editor. 2. Search for the "Listen" directive at the OHS server configuration scope. 3. Set the "Listen" directive to "80" for http ports and "443" for https ports.