cis-apache24-7-1

name	cis-apache24-7.1
description	Ensure mod_ssl and/or mod_nss Is Installed
category	cis-apache
version	2.3.0
author	cyberstrike-official
tags	["cis","apache","linux","ssl","tls","certificates","encryption"]
cis_id	7.1
cis_benchmark	CIS Apache HTTP Server 2.4 Benchmark v2.3.0
tech_stack	["linux","apache"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure mod_ssl and/or mod_nss Is Installed (Automated)

Profile Applicability

Level 1

Description

Secure Sockets Layer (SSL) was developed by Netscape and turned into an open standard and was renamed Transport Layer Security (TLS) as part of the process. TLS is important for protecting communication and can provide authentication of the server and even the client. However, contrary to vendor claims, implementing SSL does NOT directly make your web server secure! It is used to encrypt traffic and therefore does provide confidentiality of private information and users credentials. Keep in mind, however that just because you have encrypted the data in transit does not mean that the data provided by the client is secure while it is on the server. Also, SSL does not protect the web server, as attackers will easily target SSL-Enabled web servers, and the attack will be hidden in the encrypted channel.

The mod_ssl module is the standard, most used module that implements SSL/TLS for Apache. A newer module found on Red Hat systems can be a compliment or replacement for mod_ssl and provides the same functionality plus additional security services. The mod_nss is an Apache module implementation of the Network Security Services (NSS) software from Mozilla, which implements a wide range of cryptographic functions in addition to TLS.

Rationale

It is best to plan for SSL/TLS implementation from the beginning of any new web server. As most web servers have some need for SSL/TLS due to:

• Non-public information submitted that should be protected as it's transmitted to the web server.
• Non-public information that is downloaded from the web server.
• Users are going to be authenticated to some portion of the web server
• There is a need to authenticate the web server to ensure users that they have reached the real web server and have not been phished or redirected to a bogus site.

Audit Procedure

Perform the following steps to determine if the recommended state is implemented:

Ensure the mod_ssl and/or mod_nss is loaded in the Apache configuration:

# httpd -M | egrep 'ssl_module|nss_module'

Results should show either or both of the modules.

Remediation

Perform either of the following to implement the recommended state:

1. For Apache installations built from the source, use the option --with-ssl= to specify the openssl path, and the --enable-ssl configure option to add the SSL modules to the build. The --with-included-apr configure option may be necessary if there are conflicts with the APR version. If a new version of Openssl is needed it may be downloaded from http://www.openssl.org/ See the Apache documentation on building from source details.