cis-apache-6-3

name	cis-apache-6.3
description	Ensure the Server Access Log Is Configured Correctly
category	cis-apache
version	3.6.0
author	cyberstrike-official
tags	["cis","apache","linux","logging","monitoring"]
cis_id	6.3
cis_benchmark	CIS Apache HTTP Server 2.2 Benchmark v3.6.0
tech_stack	["linux","apache"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure the Server Access Log Is Configured Correctly

Description

The LogFormat directive defines the format and information to be included in the server access log entries. The CustomLog directive specifies the log file, syslog facility, or piped logging utility.

Rationale

The server access logs are invaluable for a variety of reasons. They can be used to determine what resources are being used most. Most importantly, they can be used to investigate anomalous behavior that may be an indication an attack is pending or has occurred. If the server only logs errors and does not log successful access, it is very difficult to investigate incidents. You may see that the errors stop and wonder if the attacker gave up or if the attack was successful.

Audit Procedure

Perform the following steps to determine if the recommended state is implemented:

1. Verify the CustomLog directive is configured to an appropriate log file, syslog facility, or piped logging utility and the directive uses a log format that includes all of the format string tokens listed below. The log format string may be specified as a LogFormat nickname or as an explicit string. For example, either of the following two configurations are compliant:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined
CustomLog log/access_log combined

CustomLog log/access_log "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""

The log format string should include the following tokens in any order. The portion "= description text. " describes the information to be logged.

• %h = Remote hostname or IP address if HostnameLookups is set to Off, which is the default.
• %l = Remote logname / identity.
• %u = Remote user, if the request was authenticated.
• %t = Time the request was received,
• %r = First line of request.
• %>s = Final status.
• %b = Size of response in bytes.
• %{Referer}i = Variable value for Referer header.
• %{User-agent}i = Variable value for User Agent header.

2. Verify there is a similar CustomLog directives for each virtual host configured if the virtual host will have different people responsible for the web site.

Remediation