Menü
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-apache24-3-1Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.
Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.
SKILL.md wird angezeigt
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Basierend auf der SOC-Berufsklassifikation
| name | cis-apache24-3.1 |
| description | Ensure the Apache Web Server Runs As a Non-Root User |
| category | cis-apache |
| version | 2.3.0 |
| author | cyberstrike-official |
| tags | ["cis","apache","linux","privileges","permissions","ownership","user"] |
| cis_id | 3.1 |
| cis_benchmark | CIS Apache HTTP Server 2.4 Benchmark v2.3.0 |
| tech_stack | ["linux","apache"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Although Apache is typically started with root privileges in order to listen on port 80 and 443, it can and should run as another non-root user in order to perform the web services. The Apache User and Group directives are used to designate the user and group that the Apache worker processes will assume.
One of the best ways to reduce your exposure to attack when running a web server is to create a unique, unprivileged user and group for the server application. The nobody or daemon user and group that comes default on Unix variants should NOT be used to run the web server, since the account may be commonly used for other separate daemon services. Instead, an account used only by the apache software so as to not give unnecessary access to other services. Also, the identifier used for the apache user should be a unique system account. System user accounts UID numbers have lower values which are reserved for the special system accounts not used by regular users, such as discussed in User Accounts section of the CIS Red Hat benchmark. Typically, system accounts numbers range from 1-999, or 1-499 and are defined in the /etc/login.defs file.
As an even more secure alternative, if the Apache web server can be run on high unprivileged ports, then it is not necessary to start Apache as root, and all of the Apache processes may be run as the Apache specific user as described below.
Ensure the apache account is unique and has been created with a UID less than the minimum normal user account with the Apache group and configured in the httpd.conf file.
# grep -i '^User' $APACHE_PREFIX/conf/httpd.confUser apache# grep -i '^Group' $APACHE_PREFIX/conf/httpd.confGroup apache# grep '^UID_MIN' /etc/login.defs# id apacheThe UID must be less than the UID_MIN value in /etc/login.defs, and group of apache similar to the following entries:
UID_MIN 1000
uid=48(apache) gid=48(apache) groups=48(apache)
# ps axu | grep httpd | grep -v '^root'Perform the following:
# groupadd -r apache# useradd apache -r -g apache -d /var/www -s /sbin/nologinUser apacheGroup apacheThe default Apache user and group are configured as daemon.