Remote authors or content providers will only use secure encrypted logons and connections to upload files to the Document Root directory.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-13686	WG235	SV-14278r2_rule	EBRP-1 EBRU-1	High

Description
Logging in to a web server via a telnet session or using HTTP or FTP in order to upload documents to the web site is a risk if proper encryption is not utilized to protect the data being transmitted. A secure shell service or HTTPS needs to be installed and in use for these purposes.

STIG	Date
Web Server STIG	2010-10-07

Details

Check Text ( C-30006r1_chk )
Query the SA to determine if there is a process for the uploading of files to the web site. This process should include the requirement for the use of a secure encrypted logon and secure encrypted connection. NOTE: See results from WG230 for data that will assist in the validation of this vulnerability. If the remote users are uploading files without utilizing approved encryption methods, this is a finding.

Check Text ( C-30006r1_chk )

Query the SA to determine if there is a process for the uploading of files to the web site. This process should include the requirement for the use of a secure encrypted logon and secure encrypted connection.

NOTE: See results from WG230 for data that will assist in the validation of this vulnerability.

If the remote users are uploading files without utilizing approved encryption methods, this is a finding.

Fix Text (F-26857r1_fix)
Use only secure encrypted logons and connections for uploading files to the web site.