CIS安全指南：Apache HTTP Server 2.4基准测试

需积分: 5 117 浏览量更新于2024-06-21 收藏 1.67MB PDF 举报

身份认证购VIP最低享 7 折!

领优惠券(最高得80元）

"CIS-Apache-HTTP-Server-2.4-Benchmark-V2.1.0-PDF.PDF" 该文件是"CIS Apache HTTP Server 2.4 Benchmark"的第2.1.0版，发布日期为2023年6月29日。它由网络安全与基准组织"CIS"（Center for Internet Security）提供，主要针对Apache Web服务器的2.4版本进行安全测评。文件包含了对Apache服务器的安全配置指南，旨在帮助管理员遵循最佳实践来增强服务器的安全性。文档首先介绍了使用条款，并提供了链接以便查阅。接着，内容目录展示了文档结构，包括概述、目标受众、共识指导、排版约定、推荐定义等章节。在推荐定义部分，详细说明了标题、评估状态、自动化与手动执行、配置文件、描述、理由声明、影响声明、审计程序、补救程序、默认值以及参考文献等相关概念。 CIS关键安全控制（CIS Controls）被提及，这是一套广泛认可的网络安全最佳实践，用于保护组织免受网络攻击。文件还包含额外信息和配置文件定义，以及致谢部分，表明了这份基准文档的开发过程中得到了多方贡献。主体部分从规划与安装开始，提供了一系列推荐的安全措施，例如： 1.1 确保预安装规划检查列表已实施：这是一个手动过程，强调在安装Apache之前应进行详尽的规划，以避免安全疏漏。 1.2 确保服务器不是多用途系统：建议专机专用，避免在同一个服务器上运行多种服务，以降低风险。 1.3 确保从适当的二进制文件安装Apache：推荐从官方或可信赖的源获取软件，以防止恶意篡改。 2.1 只启用必要的认证和授权模块：为了减少攻击面，只开启必要的安全模块，避免不必要的功能增加潜在安全风险。文档中还涵盖了其他多个章节，如最小化Apache模块、强化日志记录、安全配置选项等，每个章节都详细说明了审计和修复步骤，并提供了默认值和参考资料。这份文件对于任何管理Apache 2.4服务器的人来说都是宝贵的资源，有助于实现和维护一个安全、合规的Web服务环境。

资源详情

资源推荐

Page 15

1.2 Ensure the Server Is Not a Multi-Use System (Manual)

Profile Applicability:

• Level 1

• Level 2

Description:

Default server configurations often expose a wide variety of services unnecessarily

increasing the risk to the system. Just because a server can perform many services

doesn't mean it is wise to do so. The number of services and daemons executing on the

Apache Web server should be limited to those necessary, with the Web server being

the only primary function of the server.

Rationale:

Maintaining a server for a single purpose increases the security of your application and

system. The more services which are exposed to an attacker, the more potential vectors

an attacker has to exploit the system and therefore the higher the risk for the server. A

Web server should function as only a web server and if possible, should not be mixed

with other primary functions such as mail, DNS, database or middleware.

Audit:

Leverage the package or services manager for your OS to list enabled services and

review with documented business needs of the server. On Red Hat systems, the

following will produce the list of current services enabled:

chkconfig --list | grep ':on'

Remediation:

Leverage the package or services manager for your OS to uninstall or disable

unneeded services. On Red Hat systems, the following will disable a given service:

chkconfig <servicename> off

Default Value:

Depends on OS Platform

Page 17

1.3 Ensure Apache Is Installed From the Appropriate Binaries

(Manual)

Profile Applicability:

• Level 1

• Level 2

Description:

The CIS Apache Benchmark recommends using the Apache binary provided by your

vendor for most situations in order to reduce the effort and increase the effectiveness of

maintenance and security patches. However, to keep the benchmark as generic and

applicable to all Unix/Linux platforms as possible, a default source build has been used

for this benchmark.

Important Note: There is a major difference between source builds and most vendor

packages that is very important to highlight. The default source build of Apache is fairly

conservative and minimalist in the modules included and therefore starts off in a fairly

strong security state, while most vendor binaries are typically very well loaded with most

of the functionality that one may be looking for. Therefore, it is important that you

don't assume the default value shown in the benchmark will match default values

in your installation. You should always test any new installation in your environment

before putting it into production. Also keep in mind you can install and run a new version

alongside the old one by using a different Apache prefix and a different IP address or

port number in the Listen directive.

Rationale:

The benefits of using the vendor supplied binaries include:

• Ease of installation as it will just work, straight out of the box.

• It is customized for your OS environment.

• It will be tested and have gone through QA procedures.

• Everything you need is likely to be included, probably including some third-party

modules. For example, many OS vendors ship Apache with mod_ssl and

OpenSSL, PHP, mod_perl, and ModSecurity.

• Your vendor will tell you about security issues so you have to look in fewer

places.

• Updates to fix security issues will be easy to apply. The vendor will have already

verified the problem, checked the signature on the Apache download, worked out

the impact and so on.

• You may be able to get the updates automatically, reducing the window of risk.

剩余255页未读，继续阅读

FEI891225

粉丝: 2
资源: 37

CIS安全指南：Apache HTTP Server 2.4基准测试

CIS-Apache-Cassandra-3.11-Benchmark-v1.0.0.pdf

Scene-Graph-Benchmark.pytorch

如何将电脑上D盘中的benchmarksql-5.0.tar.gz上传到ubuntu20.04.6

sysbench tpcc --mysql-db=tpcc --mysql-user=root --mysql-password=123456 --mysql-host=0.0.0.0 --tables=1 --scale=500 --trx_level=RC --threads=64 --time=300 run sysbench 1.0.20 (using bundled LuaJIT 2.1.0-beta2) FATAL: Cannot find benchmark 'tpcc': no such built-in test, file or module怎么解决

如何将电脑上benchmarksql-5.0.tar.gz上传到ubuntu20.04.6，并在ubuntu20.04.6下进行mysql压测

如何将电脑上D盘中的benchmarksql-5.0.tar.gz上传到ubuntu20.04.6，并在ubuntu20.04.6下进行mysql压测

linux常用redis命令大全

如何打开电脑桌面上的benchmarksql-5.0.tar.gz文件，并对mysql压测

使用第6个命令时，出现以下错误 "/home/chen-docker/llvm/llvm-14.0.0.src/../third-party/benchmark" which is not an existing directory.

cudnn.benchmark = True

torch.backends.cudnn.benchmark = True torch.backends.cudnn.deterministic = True

root@DESKTOP-0CU081I:/tpcc-mysql# sysbench --db-driver=mysql --mysql-db=tpcc --mysql-user=user --mysql-password=password --table-size=100000 prepare sysbench 1.0.20 (using bundled LuaJIT 2.1.0-beta2) FATAL: Cannot find benchmark 'prepare': no such built-in test, file or module怎么解决

cudnn.benchmark

torch.backends.cudnn.benchmark = False torch.backends.cudnn.deterministic = True

./benchmark: error while loading shared libraries: libmindspore-lite.so: cannot open shared object file: No such file or directory

tools/analysis_tools/benchmark.py

torch.backends.cudnn.benchmark = False

maskrcnn-benchmark搭建报错subprocess.CalledProcessError: Command '['ninja', '-v']' returned non-zero exit status 1.

常用芯片手册芯片资料MAX260常用芯片手册芯片资料MAX260

最新资源