debian/ossec-hids/var/ossec/etc/shared/cis_apache2224_rcl.txt

   1 # OSSEC Linux Audit - (C) 2018
   2 #
   3 # Released under the same license as OSSEC.
   4 # More details at the LICENSE file included with OSSEC or online
   5 # at: https://github.com/ossec/ossec-hids/blob/master/LICENSE
   6 #
   7 # [Application name] [any or all] [reference]
   8 # type:<entry name>;
   9 #
  10 # Type can be:
  11 #             - f (for file or directory)
  12 #             - p (process running)
  13 #             - d (any file inside the directory)
  14 #
  15 # Additional values:
  16 # For the registry , use "->" to look for a specific entry and another
  17 # "->" to look for the value.
  18 # For files, use "->" to look for a specific value in the file.
  19 #
  20 # Values can be preceeded by: =: (for equal) - default
  21 #                             r: (for ossec regexes)
  22 #                             >: (for strcmp greater)
  23 #                             <: (for strcmp  lower)
  24 # Multiple patterns can be specified by using " && " between them.
  25 # (All of them must match for it to return true).
  26
  27 # CIS Checks for Apache Https Server
  28 # Based on Center for Internet Security Benchmark for Apache HttpSserver 2.4 v1.3.1 and Apache HttpsServer 2.2 v3.4.1 (https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308)
  29 #
  30 #
  31 $main-conf=/etc/apache2/apache2.conf,/etc/httpd/conf/httpd.conf;
  32 $conf-dirs=/etc/apache2/conf-enabled,/etc/apache2/mods-enabled,/etc/apache2/sites-enabled,/etc/httpd/conf.d,/etc/httpd/modsecurity.d;
  33 $ssl-confs=/etc/apache2/mods-enabled/ssl.conf,/etc/httpd/conf.d/ssl.conf;
  34 $mods-en=/etc/apache2/mods-enabled;
  35 $request-confs=/etc/httpd/conf/httpd.conf,/etc/apache2/mods-enabled/reqtimeout.conf;
  36 $traceen=/etc/apache2/apache2.conf,/etc/httpd/conf/httpd.conf,/etc/apache2/conf-enabled/security.conf;
  37 #
  38 #
  39 #2.3 Disable WebDAV Modules
  40 [CIS - Apache Configuration - 2.3: WebDAV Modules are enabled] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
  41 d:$conf-dirs -> conf -> !r:^# && r:loadmodule\sdav;
  42 d:$conf-dirs -> load -> !r:^# && r:loadmodule\sdav;
  43 f:/etc/httpd/conf.d -> !r:^# && r:loadmodule\sdav;
  44 d:$mods-en -> dav.load;
  45 #
  46 #
  47 #2.4 Disable Status Module
  48 [CIS - Apache Configuration - 2.4: Status Module is enabled] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
  49 d:$conf-dirs -> conf -> !r:^# && r:loadmodule\sstatus;
  50 d:$conf-dirs -> load -> !r:^# && r:loadmodule\sstatus;
  51 f:/etc/httpd/conf.d -> !r:^# && r:loadmodule\sstatus;
  52 d:$mods-en -> status.load;
  53 #
  54 #
  55 #2.5 Disable Autoindex Module
  56 [CIS - Apache Configuration - 2.5: Autoindex Module is enabled] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
  57 d:$conf-dirs -> conf -> !r:^# && r:loadmodule\sautoindex;
  58 d:$conf-dirs -> load -> !r:^# && r:loadmodule\sautoindex;
  59 f:/etc/httpd/conf.d -> !r:^# && r:loadmodule\sautoindex;
  60 d:$mods-en -> autoindex.load;
  61 #
  62 #
  63 #2.6 Disable Proxy Modules
  64 [CIS - Apache Configuration - 2.6: Proxy Modules are enabled] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
  65 d:$conf-dirs -> conf -> !r:^# && r:loadmodule\sproxy;
  66 d:$conf-dirs -> load -> !r:^# && r:loadmodule\sproxy;
  67 f:/etc/httpd/conf.d -> !r:^# && r:loadmodule\sproxy;
  68 d:$mods-en -> proxy.load;
  69 #
  70 #
  71 #2.7 Disable User Directories Modules
  72 [CIS - Apache Configuration - 2.7: User Directories Modules are enabled] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
  73 d:$conf-dirs -> conf -> !r:^# && r:loadmodule\suserdir;
  74 d:$conf-dirs -> load -> !r:^# && r:loadmodule\suserdir;
  75 f:/etc/httpd/conf.d -> !r:^# && r:loadmodule\suserdir;
  76 d:$mods-en -> userdir.load;
  77 #
  78 #
  79 #2.8 Disable Info Module
  80 [CIS - Apache Configuration - 2.8: Info Module is enabled] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
  81 d:$conf-dirs -> conf -> !r:^# && r:loadmodule\sinfo;
  82 d:$conf-dirs -> load -> !r:^# && r:loadmodule\sinfo;
  83 d:$conf-dirs -> conf -> !r:^# && r:loadmodule\sinfo;
  84 d:$mods-en -> info.load;
  85 #
  86 #
  87 #3.2 Give the Apache User Account an Invalid Shell
  88 [CIS - Apache Configuration - 3.2: Apache User Account has got a valid shell] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
  89 f:/etc/passwd -> r:/var/www && !r:\.*/bin/false$|/sbin/nologin$;
  90 #
  91 #
  92 #3.3 Lock the Apache User Account
  93 [CIS - Apache Configuration - 3.3: Lock the Apache User Account] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
  94 f:/etc/shadow -> r:^daemon|^wwwrun|^www-data|^apache && !r:\p!\.*$;
  95 #
  96 #
  97 #4.4 Restrict Override for All Directories
  98 [CIS - Apache Configuration - 4.4: Restrict Override for All Directories] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
  99 d:$conf-dirs -> conf -> !r:^# && !r:\w+ && r:allowoverride && !r:none$;
 100 d:$conf-dirs -> conf -> !r:^# && !r:\w+ && r:allowoverridelist;
 101 f:$main-conf -> !r:^# && !r:\w+ && r:allowoverride && !r:none$;
 102 f:$main-conf -> !r:^# && !r:\w+ && r:allowoverridelist;
 103 #
 104 #
 105 #5.3 Minimize Options for Other Directories
 106 [CIS - Apache Configuration - 5.3: Minimize Options for other directories] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 107 d:$conf-dirs -> conf -> !r:^# && r:options\sincludes;
 108 f:$main-conf -> !r:^# && r:options\sincludes;
 109 #
 110 #
 111 #5.4.1 Remove default index.html sites
 112 [CIS - Apache Configuration - 5.4.1: Remove default index.html sites] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 113 d:/var/www -> index.html;
 114 d:/var/www/html -> index.html;
 115 #
 116 #
 117 #5.4.2 Remove the Apache user manual
 118 [CIS - Apache Configuration - 5.4.2: Remove the Apache user manual] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 119 d:/etc/httpd/conf.d -> manual.conf;
 120 d:/etc/apache2/conf-enabled -> apache2-doc.conf;
 121 #
 122 #
 123 #5.4.5 Verify that no Handler is enabled
 124 [CIS - Apache Configuration - 5.4.5: A Handler is configured] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 125 d:$conf-dirs -> conf -> !r:^# && r:/wsethandler;
 126 f:$main-conf -> !r:^# && r:/wsethandler;
 127 #
 128 #
 129 #5.5 Remove default CGI content printenv
 130 [CIS - Apache Configuration - 5.5: Remove default CGI content printenv] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 131 d:/var/www/cgi-bin -> printenv;
 132 d:/usr/lib/cgi-bin -> printenv;
 133 #
 134 #
 135 #5.6 Remove default CGI content test-cgi
 136 [CIS - Apache Configuration - 5.6: Remove default CGI content test-cgi] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 137 d:/var/www/cgi-bin -> test-cgi;
 138 d:/usr/lib/cgi-bin -> test-cgi;
 139 #
 140 #
 141 #5.7 Limit HTTP Request Method
 142 [CIS - Apache Configuration - 5.7: Disable HTTP Request Method] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 143 f:$main-conf -> !r:<limitexcept\sget\spost\soptions>;
 144 #
 145 #
 146 #5.8 Disable HTTP Trace Method
 147 [CIS - Apache Configuration - 5.8: Disable HTTP Trace Method] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 148 f:$traceen -> !r:^# && r:traceenable\s+on\s*$;
 149 #
 150 #
 151 #5.9 Restrict HTTP Protocol Versions
 152 [CIS - Apache Configuration - 5.9: Restrict HTTP Protocol Versions] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 153 f:/etc/httpd/conf/httpd.conf -> !r:loadmodule\srewrite;
 154 d:$mods-en -> !f:rewrite.load;
 155 f:$main-conf -> !r:rewriteengine\son;
 156 f:$main-conf -> !r:rewritecond && !r:%{THE_REQUEST} && !r:!HTTP/1\\.1\$;
 157 f:$main-conf -> !r:rewriterule && !r:.* - [F];
 158 #
 159 #
 160 #5.12 Deny IP Address Based Requests
 161 [CIS - Apache Configuration - 5.12: Deny IP Address Based Requests] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 162 f:/etc/httpd/conf/httpd.conf -> !r:loadmodule\srewrite;
 163 d:$mods-en -> !f:rewrite.load;
 164 f:$main-conf -> !r:rewriteengine\son;
 165 f:$main-conf -> !r:rewritecond && !r:%{HTTP_HOST} && !r:www\\.\w+\\.\w+ [NC]$;
 166 f:$main-conf -> !r:rewritecond && !r:%{REQUEST_URI} && !r:/error [NC]$;
 167 f:$main-conf -> !r:rewriterule && !r:.\(.*\) - [L,F]$;
 168 #
 169 #
 170 #5.13 Restrict Listen Directive
 171 [CIS - Apache Configuration - 5.13: Restrict Listen Directive] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 172 d:$conf-dirs -> conf -> !r:^# && r:listen\s80$;
 173 d:$conf-dirs -> conf -> !r:^# && r:listen\s0.0.0.0\p80;
 174 d:$conf-dirs -> conf -> !r:^# && r:listen\s[\p\pffff\p0.0.0.0]\p80;
 175 f:$main-conf -> !r:^# && r:listen\s80$;
 176 f:$main-conf -> !r:^# && r:listen\s0.0.0.0\p\d*;
 177 f:$main-conf -> !r:^# && r:listen\s[\p\pffff\p0.0.0.0]\p\d*;
 178 f:/etc/apache2/sites-enabled/000-default.conf -> !r:^# && r:listen\s80$;
 179 f:/etc/apache2/sites-enabled/000-default.conf -> !r:^# && r:listen\s0.0.0.0\p\d*;
 180 f:/etc/apache2/sites-enabled/000-default.conf -> !r:^# && r:listen\s[\p\pffff\p0.0.0.0]\p\d*;
 181 f:/etc/apache2/ports.conf -> !r:^# && r:listen\s80$;
 182 f:/etc/apache2/ports.conf -> !r:^# && r:listen\s0.0.0.0\p\d*;
 183 f:/etc/apache2/ports.conf -> !r:^# && r:listen\s[\p\pffff\p0.0.0.0]\p\d*;
 184 #
 185 #
 186 #5.14 Restrict Browser Frame Options
 187 [CIS - Apache Configuration - 5.14: Restrict Browser Frame Options] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 188 f:$main-conf -> !r:header\salways\sappend\sx-frame-options && !r:sameorigin|deny;
 189 #
 190 #
 191 #6.1 Configure the Error Log to notice at least
 192 [CIS - Apache Configuration - 6.1: Configure the Error Log to notice at least] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 193 f:$main-conf -> !r:^# && r:loglevel\snotice\score\p && r:warn|emerg|alert|crit|error|notice;
 194 f:$main-conf -> !r:loglevel\snotice\score\p && !r:info|debug;
 195 #
 196 #
 197 #6.2 Configure a Syslog facility for Error Log
 198 [CIS - Apache Configuration - 6.2: Configure a Syslog facility for Error Log] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 199 f:$main-conf -> !r:errorlog\s+\p*syslog\p\.*\p*;
 200 #
 201 #
 202 #7.6 Disable SSL Insecure Renegotiation
 203 [CIS - Apache Configuration - 7.6: Disable SSL Insecure Renegotiation] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 204 f:$ssl-confs -> !r:^\t*\s*# && r:sslinsecurerenegotiation\s+on\s*;
 205 f:$ssl-confs -> !r:^\t*\s*# && r:sslinsecurerenegotiation\s*$;
 206 #
 207 #
 208 #7.7 Ensure SSL Compression is not enabled
 209 [CIS - Apache Configuration - 7.7: Ensure SSL Compression is not enabled] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 210 f:$ssl-confs -> !r:^\t*\s*# && r:sslcompression\s+on\s*;
 211 f:$ssl-confs -> !r:^\t*\s*# && r:sslcompression\s*$;
 212 #
 213 #
 214 #7.8 Disable SSL TLS v1.0 Protocol
 215 [CIS - Apache Configuration - 7.8: Disable insecure TLS Protocol] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 216 f:$ssl-confs -> !r:^\t*\s*sslprotocol;
 217 f:$ssl-confs -> !r:^\t*\s*# && r:sslprotocol\s+all;
 218 f:$ssl-confs -> !r:^\t*\s*# && r:sslprotocol\s+\.*tlsv1\P\s*;
 219 f:$ssl-confs -> !r:^\t*\s*# && r:sslprotocol\s+\.*sslv2\P\s*;
 220 f:$ssl-confs -> !r:^\t*\s*# && r:sslprotocol\s+\.*sslv3\P\s*;
 221 #
 222 #
 223 #7.9 Enable OCSP Stapling
 224 [CIS - Apache Configuration - 7.9: Enable OCSP Stapling] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 225 f:/etc/httpd/conf/httpd.conf -> !r:^loadmodule\s+ssl;
 226 d:$mods-en -> !f:ssl.load;
 227 f:$ssl-confs -> !r:\t*\s*# && r:sslusestapling\s+off;
 228 f:$ssl-confs -> !r:\t*\s*sslusestapling\s+on;
 229 f:$ssl-confs -> !r:\t*\s*sslstaplingcache\s+\.+;
 230 #
 231 #
 232 #7.10 Enable HTTP Strict Transport Security
 233 [CIS - Apache Configuration - 7.10: Enable HTTP Strict Transport Security] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 234 f:/etc/apache2/apache2.conf -> !r:Header\salways\sset\sStrict-Transport-Security\s"max-age=\d\d\d\d*";
 235 f:/etc/apache2/apache2.conf -> !r:^# && r:Header\salways\sset\sStrict-Transport-Security\s"max-age=1\d\d";
 236 f:/etc/apache2/apache2.conf -> !r:^# && r:Header\salways\sset\sStrict-Transport-Security\s"max-age=2\d\d";
 237 f:/etc/apache2/apache2.conf -> !r:^# && r:Header\salways\sset\sStrict-Transport-Security\s"max-age=3\d\d";
 238 f:/etc/apache2/apache2.conf -> !r:^# && r:Header\salways\sset\sStrict-Transport-Security\s"max-age=4\d\d";
 239 f:/etc/apache2/apache2.conf -> !r:^# && r:Header\salways\sset\sStrict-Transport-Security\s"max-age=5\d\d";
 240 #
 241 #
 242 #8.1 Set ServerToken to Prod or ProductOnly
 243 [CIS - Apache Configuration - 8.1: Set ServerToken to Prod or ProductOnly] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 244 d:$conf-dirs -> conf -> !r:^# && r:servertokens\s+major;
 245 d:$conf-dirs -> conf -> !r:^# && r:servertokens\s+minor;
 246 d:$conf-dirs -> conf -> !r:^# && r:servertokens\s+min;
 247 d:$conf-dirs -> conf -> !r:^# && r:servertokens\s+minimal;
 248 d:$conf-dirs -> conf -> !r:^# && r:servertokens\s+os;
 249 d:$conf-dirs -> conf -> !r:^# && r:servertokens\s+full;
 250 #
 251 #
 252 #8.2: Set ServerSignature to Off
 253 [CIS - Apache Configuration - 8.2: Set ServerSignature to Off] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 254 d:$conf-dirs -> conf -> !r:^# && r:serversignature\s+email;
 255 d:$conf-dirs -> conf -> !r:^# && r:serversignature\s+on;
 256 #
 257 #
 258 #8.3: Prevent Information Leakage via Default Apache Content
 259 [CIS - Apache Configuration - 8.3: Prevent Information Leakage via Default Apache Content] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 260 d:$conf-dirs -> conf -> !r:^\t*\s*# && r:include\s*\w*httpd-autoindex.conf;
 261 d:$conf-dirs -> conf -> !r:^\t*\s*# && r:alias\s*/icons/\s*\.*;
 262 #
 263 #
 264 #9.1:Set TimeOut to 10 or less
 265 [CIS - Apache Configuration - 9.1: Set TimeOut to 10 or less] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 266 f:$main-conf -> !r:^# && r:timeout\s+9\d;
 267 f:$main-conf -> !r:^# && r:timeout\s+8\d;
 268 f:$main-conf -> !r:^# && r:timeout\s+7\d;
 269 f:$main-conf -> !r:^# && r:timeout\s+6\d;
 270 f:$main-conf -> !r:^# && r:timeout\s+5\d;
 271 f:$main-conf -> !r:^# && r:timeout\s+4\d;
 272 f:$main-conf -> !r:^# && r:timeout\s+3\d;
 273 f:$main-conf -> !r:^# && r:timeout\s+2\d;
 274 f:$main-conf -> !r:^# && r:timeout\s+11;
 275 f:$main-conf -> !r:^# && r:timeout\s+12;
 276 f:$main-conf -> !r:^# && r:timeout\s+13;
 277 f:$main-conf -> !r:^# && r:timeout\s+14;
 278 f:$main-conf -> !r:^# && r:timeout\s+15;
 279 f:$main-conf -> !r:^# && r:timeout\s+16;
 280 f:$main-conf -> !r:^# && r:timeout\s+17;
 281 f:$main-conf -> !r:^# && r:timeout\s+18;
 282 f:$main-conf -> !r:^# && r:timeout\s+19;
 283 f:$main-conf -> !r:^timeout\s+\d\d*;
 284 f:$main-conf -> !r:^# && r:timeout\s+\d\d\d+;
 285 #
 286 #
 287 #9.2:Set the KeepAlive directive to On
 288 [CIS - Apache Configuration - 9.2: Set the KeepAlive directive to On] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 289 f:$main-conf -> !r:^# && r:keepalive\s+off;
 290 f:$main-conf -> !r:keepalive\s+on;
 291 #
 292 #
 293 #9.3:Set MaxKeepAliveRequests to 100 or greater
 294 [CIS - Apache Configuration - 9.3: Set MaxKeepAliveRequest to 100 or greater] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 295 f:$main-conf -> !r:^maxkeepaliverequests\s+\d\d\d+;
 296 #
 297 #
 298 #9.4: Set KeepAliveTimeout Low to Mitigate Denial of Service
 299 [CIS - Apache Configuration - 9.4: Set KeepAliveTimeout Low] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 300 f:$main-conf -> !r:keepalivetimeout\s+\d\d*;
 301 f:$main-conf -> !r:^# && r:keepalivetimeout\s+16;
 302 f:$main-conf -> !r:^# && r:keepalivetimeout\s+17;
 303 f:$main-conf -> !r:^# && r:keepalivetimeout\s+18;
 304 f:$main-conf -> !r:^# && r:keepalivetimeout\s+19;
 305 f:$main-conf -> !r:^# && r:keepalivetimeout\s+2\d;
 306 f:$main-conf -> !r:^# && r:keepalivetimeout\s+3\d;
 307 f:$main-conf -> !r:^# && r:keepalivetimeout\s+4\d;
 308 f:$main-conf -> !r:^# && r:keepalivetimeout\s+5\d;
 309 f:$main-conf -> !r:^# && r:keepalivetimeout\s+6\d;
 310 f:$main-conf -> !r:^# && r:keepalivetimeout\s+7\d;
 311 f:$main-conf -> !r:^# && r:keepalivetimeout\s+8\d;
 312 f:$main-conf -> !r:^# && r:keepalivetimeout\s+9\d;
 313 f:$main-conf -> !r:^# && r:keepalivetimeout\s+\d\d\d+;
 314 #
 315 #
 316 #9.5 Set Timeout Limits for Request Headers
 317 [CIS - Apache Configuration - 9.5: Set Timeout Limits for Request Headers] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 318 f:/etc/httpd/conf/httpd.conf -> !r:^loadmodule\s+reqtimeout;
 319 d:$mods-en -> !f:reqtimeout.load;
 320 f:$request-confs -> !r:^\t*\s*requestreadtimeout\.+header\p\d\d*\D\d\d*;
 321 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+header\p\d\d\D41;
 322 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+header\p\d\d\D42;
 323 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+header\p\d\d\D43;
 324 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+header\p\d\d\D44;
 325 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+header\p\d\d\D45;
 326 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+header\p\d\d\D46;
 327 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+header\p\d\d\D47;
 328 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+header\p\d\d\D48;
 329 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+header\p\d\d\D49;
 330 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+header\p\d\d\D5\d;
 331 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+header\p\d\d\D6\d;
 332 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+header\p\d\d\D7\d;
 333 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+header\p\d\d\D8\d;
 334 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+header\p\d\d\D9\d;
 335 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+header\p\d\d\D\d\d\d+;
 336 #
 337 #
 338 #9.6 Set Timeout Limits for Request Body
 339 [CIS - Apache Configuration - 9.6: Set Timeout Limits for Request Body] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 340 f:/etc/httpd/conf/httpd.conf -> !r:^loadmodule\s+reqtimeout;
 341 d:$mods-en -> !f:reqtimeout.load;
 342 f:$request-confs -> !r:\t*\s*requestreadtimeout\.+body\p\d\d*;
 343 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+body\p21;
 344 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+body\p22;
 345 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+body\p23;
 346 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+body\p24;
 347 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+body\p25;
 348 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+body\p26;
 349 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+body\p27;
 350 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+body\p28;
 351 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+body\p29;
 352 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+body\p3\d;
 353 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+body\p4\d;
 354 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+body\p5\d;
 355 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+body\p6\d;
 356 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+body\p7\d;
 357 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+body\p8\d;
 358 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+body\p9\d;
 359 f:$request-confs -> !r:^\t*\s*# && r:\t*\s*requestreadtimeout\.+body\p\d\d\d+;
 360 #
 361 #
 362 #10.1 Set the LimitRequestLine directive to 512 or less
 363 [CIS - Apache Configuration - 10.1: Set LimitRequestLine to 512 or less] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 364 f:$main-conf -> !r:^limitrequestline\s+\d\d\d;
 365 f:$main-conf -> !r:^# && r:limitrequestline\s+5\13;
 366 f:$main-conf -> !r:^# && r:limitrequestline\s+5\14;
 367 f:$main-conf -> !r:^# && r:limitrequestline\s+5\15;
 368 f:$main-conf -> !r:^# && r:limitrequestline\s+5\16;
 369 f:$main-conf -> !r:^# && r:limitrequestline\s+5\17;
 370 f:$main-conf -> !r:^# && r:limitrequestline\s+5\18;
 371 f:$main-conf -> !r:^# && r:limitrequestline\s+5\19;
 372 f:$main-conf -> !r:^# && r:limitrequestline\s+5\2\d;
 373 f:$main-conf -> !r:^# && r:limitrequestline\s+5\3\d;
 374 f:$main-conf -> !r:^# && r:limitrequestline\s+5\4\d;
 375 f:$main-conf -> !r:^# && r:limitrequestline\s+5\5\d;
 376 f:$main-conf -> !r:^# && r:limitrequestline\s+5\6\d;
 377 f:$main-conf -> !r:^# && r:limitrequestline\s+5\7\d;
 378 f:$main-conf -> !r:^# && r:limitrequestline\s+5\8\d;
 379 f:$main-conf -> !r:^# && r:limitrequestline\s+5\9\d;
 380 f:$main-conf -> !r:^# && r:limitrequestline\s+6\d\d;
 381 f:$main-conf -> !r:^# && r:limitrequestline\s+7\d\d;
 382 f:$main-conf -> !r:^# && r:limitrequestline\s+8\d\d;
 383 f:$main-conf -> !r:^# && r:limitrequestline\s+9\d\d;
 384 f:$main-conf -> !r:^# && r:limitrequestline\s+\d\d\d\d+;
 385 #
 386 #
 387 #10.2 Set the LimitRequestFields directive to 100 or less
 388 [CIS - Apache Configuration - 10.2: Set LimitRequestFields to 100 or less] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 389 f:$main-conf -> !r:^limitrequestfields\s\d\d*;
 390 f:$main-conf -> !r:^# && r:limitrequestfields\s+1\d1;
 391 f:$main-conf -> !r:^# && r:limitrequestfields\s+1\d2;
 392 f:$main-conf -> !r:^# && r:limitrequestfields\s+1\d3;
 393 f:$main-conf -> !r:^# && r:limitrequestfields\s+1\d4;
 394 f:$main-conf -> !r:^# && r:limitrequestfields\s+1\d5;
 395 f:$main-conf -> !r:^# && r:limitrequestfields\s+1\d6;
 396 f:$main-conf -> !r:^# && r:limitrequestfields\s+1\d7;
 397 f:$main-conf -> !r:^# && r:limitrequestfields\s+1\d8;
 398 f:$main-conf -> !r:^# && r:limitrequestfields\s+1\d9;
 399 f:$main-conf -> !r:^# && r:limitrequestfields\s+11\d;
 400 f:$main-conf -> !r:^# && r:limitrequestfields\s+12\d;
 401 f:$main-conf -> !r:^# && r:limitrequestfields\s+13\d;
 402 f:$main-conf -> !r:^# && r:limitrequestfields\s+14\d;
 403 f:$main-conf -> !r:^# && r:limitrequestfields\s+15\d;
 404 f:$main-conf -> !r:^# && r:limitrequestfields\s+16\d;
 405 f:$main-conf -> !r:^# && r:limitrequestfields\s+17\d;
 406 f:$main-conf -> !r:^# && r:limitrequestfields\s+18\d;
 407 f:$main-conf -> !r:^# && r:limitrequestfields\s+19\d;
 408 f:$main-conf -> !r:^# && r:limitrequestfields\s+2\d\d;
 409 f:$main-conf -> !r:^# && r:limitrequestfields\s+3\d\d;
 410 f:$main-conf -> !r:^# && r:limitrequestfields\s+4\d\d;
 411 f:$main-conf -> !r:^# && r:limitrequestfields\s+5\d\d;
 412 f:$main-conf -> !r:^# && r:limitrequestfields\s+6\d\d;
 413 f:$main-conf -> !r:^# && r:limitrequestfields\s+7\d\d;
 414 f:$main-conf -> !r:^# && r:limitrequestfields\s+8\d\d;
 415 f:$main-conf -> !r:^# && r:limitrequestfields\s+9\d\d;
 416 f:$main-conf -> !r:^# && r:limitrequestfields\s+\d\d\d\d+;
 417 #
 418 #
 419 #10.3 Set the LimitRequestFieldsize directive to 1024 or less
 420 [CIS - Apache Configuration - 10.3: Set LimitRequestFieldsize to 1024 or less] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 421 f:$main-conf -> !r:^limitrequestfieldsize\s+\d\d*;
 422 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+1\d25;
 423 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+1\d26;
 424 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+1\d27;
 425 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+1\d28;
 426 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+1\d29;
 427 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+1\d3\d;
 428 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+1\d4\d;
 429 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+1\d5\d;
 430 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+1\d6\d;
 431 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+1\d7\d;
 432 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+1\d8\d;
 433 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+1\d9\d;
 434 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+11\d\d;
 435 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+12\d\d;
 436 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+13\d\d;
 437 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+14\d\d;
 438 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+15\d\d;
 439 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+16\d\d;
 440 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+17\d\d;
 441 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+18\d\d;
 442 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+19\d\d;
 443 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+2\d\d\d;
 444 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+3\d\d\d;
 445 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+4\d\d\d;
 446 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+5\d\d\d;
 447 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+6\d\d\d;
 448 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+7\d\d\d;
 449 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+8\d\d\d;
 450 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+9\d\d\d;
 451 f:$main-conf -> !r:^# && r:limitrequestfieldsize\s+\d\d\d\d\d+;
 452 #
 453 #
 454 #10.4 Set the LimitRequestBody directive to 102400 or less
 455 [CIS - Apache Configuration - 10.4: Set LimitRequestBody to 102400 or less] [any] [https://workbench.cisecurity.org/benchmarks/307, https://workbench.cisecurity.org/benchmarks/308]
 456 f:$main-conf -> !r:^limitrequestbody\s+\d\d*;
 457 f:$main-conf -> !r:^# && r:limitrequestbody\s+0\s*$;
 458 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d24\d1;
 459 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d24\d2;
 460 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d24\d3;
 461 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d24\d4;
 462 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d24\d5;
 463 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d24\d6;
 464 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d24\d7;
 465 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d24\d8;
 466 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d24\d9;
 467 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d241\d;
 468 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d242\d;
 469 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d243\d;
 470 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d244\d;
 471 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d245\d;
 472 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d246\d;
 473 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d247\d;
 474 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d248\d;
 475 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d249\d;
 476 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d25\d\d;
 477 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d26\d\d;
 478 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d27\d\d;
 479 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d28\d\d;
 480 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d29\d\d;
 481 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d3\d\d\d;
 482 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d4\d\d\d;
 483 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d5\d\d\d;
 484 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d6\d\d\d;
 485 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d7\d\d\d;
 486 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d8\d\d\d;
 487 f:$main-conf -> !r:^# && r:limitrequestbody\s+1\d9\d\d\d;
 488 f:$main-conf -> !r:^# && r:limitrequestbody\s+11\d\d\d\d;
 489 f:$main-conf -> !r:^# && r:limitrequestbody\s+12\d\d\d\d;
 490 f:$main-conf -> !r:^# && r:limitrequestbody\s+13\d\d\d\d;
 491 f:$main-conf -> !r:^# && r:limitrequestbody\s+14\d\d\d\d;
 492 f:$main-conf -> !r:^# && r:limitrequestbody\s+15\d\d\d\d;
 493 f:$main-conf -> !r:^# && r:limitrequestbody\s+16\d\d\d\d;
 494 f:$main-conf -> !r:^# && r:limitrequestbody\s+17\d\d\d\d;
 495 f:$main-conf -> !r:^# && r:limitrequestbody\s+18\d\d\d\d;
 496 f:$main-conf -> !r:^# && r:limitrequestbody\s+19\d\d\d\d;
 497 f:$main-conf -> !r:^# && r:limitrequestbody\s+2\d\d\d\d\d;
 498 f:$main-conf -> !r:^# && r:limitrequestbody\s+3\d\d\d\d\d;
 499 f:$main-conf -> !r:^# && r:limitrequestbody\s+4\d\d\d\d\d;
 500 f:$main-conf -> !r:^# && r:limitrequestbody\s+5\d\d\d\d\d;
 501 f:$main-conf -> !r:^# && r:limitrequestbody\s+6\d\d\d\d\d;
 502 f:$main-conf -> !r:^# && r:limitrequestbody\s+7\d\d\d\d\d;
 503 f:$main-conf -> !r:^# && r:limitrequestbody\s+8\d\d\d\d\d;
 504 f:$main-conf -> !r:^# && r:limitrequestbody\s+9\d\d\d\d\d;
 505 f:$main-conf -> !r:^# && r:limitrequestbody\s+\d\d\d\d\d\d\d+;