The access control files are owned by a privileged web server account.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2256	WG280	SV-2256r4_rule	ECCD-1 ECCD-2	Medium

Description
This check verifies that the key web server system configuration files are owned by the SA or by the web administrator controlled account. These same files which control the configuration of the web server and, thus, its behavior must also be accessible by the account that runs the web service. If these files are altered by a malicious user, the web server would no longer be under the control of its managers and owners; properties in the web server configuration could be altered to compromise the entire server platform.

Description

This check verifies that the key web server system configuration files are owned by the SA or by the web administrator controlled account. These same files which control the configuration of the web server and, thus, its behavior must also be accessible by the account that runs the web service. If these files are altered by a malicious user, the web server would no longer be under the control of its managers and owners; properties in the web server configuration could be altered to compromise the entire server platform.

STIG	Date
Web Server STIG	2010-10-07

Details

Check Text ( C-29943r1_chk )
Query the SA or the web administrator to determine if an access control file is used by the web server and to obtain the name and location of those files. Verify the permissions on these files. Some examples are listed below but the specific file names may vary by web server software products. If .htaccess or the .htaccess.html files are in use, the SA or the web administrator account may have Full Control and the non-privileged web server account running the web service should have read and execute permissions. Right-click the htpasswd file, if present. Select the Properties window, then select the Security tab. Examine the access rights for the file. The SA or the web administrator account should have Full Control and the account running the web service should have read and execute permissions. The reviewer should check the permission settings for the following control files and directories, if they are present. Access to any metabase and associated adminacl property settings should be restricted to SAs, web administrators, service accounts, or authenticated users. Access permissions should be as restrictive as possible with regard to non-administrative access. IIS and Metabase Security: The BUILTIN\IWAM_computer_name and the BUILTIN\IUSR_computer_name accounts should never be members of the BUILTIN\Administrators group. The accounts associated with AnonymousUserName and WAMUserName should never be granted administrator privileges. If entries other than administrators, the web administrator accounts, or the system for any degree of access are present, this is a finding.

Check Text ( C-29943r1_chk )

Query the SA or the web administrator to determine if an access control file is used by the web server and to obtain the name and location of those files. Verify the permissions on these files. Some examples are listed below but the specific file names may vary by web server software products.

If .htaccess or the .htaccess.html files are in use, the SA or the web administrator account may have Full Control and the non-privileged web server account running the web service should have read and execute permissions.

Right-click the htpasswd file, if present. Select the Properties window, then select the Security tab. Examine the access rights for the file. The SA or the web administrator account should have Full Control and the account running the web service should have read and execute permissions.

The reviewer should check the permission settings for the following control files and directories, if they are present.

Access to any metabase and associated adminacl property settings should be restricted to SAs, web administrators, service accounts, or authenticated users. Access permissions should be as restrictive as possible with regard to non-administrative access.

IIS and Metabase Security:
The BUILTIN\IWAM_computer_name and the BUILTIN\IUSR_computer_name accounts should never be members of the BUILTIN\Administrators group. The accounts associated with AnonymousUserName and WAMUserName should never be granted administrator privileges.

If entries other than administrators, the web administrator accounts, or the system for any degree of access are present, this is a finding.

Fix Text (F-26814r1_fix)
Ensure that the owner is a privileged account and not the web server account or equivalent which runs the web service.