cis-apache-7-3

name	cis-apache-7.3
description	Ensure the Server's Private Key Is Protected
category	cis-apache
version	3.6.0
author	cyberstrike-official
tags	["cis","apache","linux","ssl","tls","certificates","encryption"]
cis_id	7.3
cis_benchmark	CIS Apache HTTP Server 2.2 Benchmark v3.6.0
tech_stack	["linux","apache"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure the Server's Private Key Is Protected

Description

It is critical to protect the server's private key. The private key is encrypted by default as a means of protecting it, but that means that the passphrase is required each time the server is started up. Now it is necessary to protect the passphrase as well. The passphrase may be typed in when it is manually started up or provided by an automated program. See http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslpassphrasedialog for details. To summarize, the options are:

1. Use SSLPassPhraseDialog builtin, which requires a passphrase to be manually entered.
2. Use SSLPassPhraseDialog |/path/to/program to provide the passphrase.
3. Use SSLPassPhraseDialog exec:/path/to/program to provide the passphrase.
4. Store the private key in clear text so a passphrase is not required.

Any of the above options 1-4 are acceptable as long as the key and passphrase are protected properly. Option 1 has the additional security benefit of not storing the passphrase but is not generally acceptable for most production web servers, since it requires the web server to be manually started. Options 2 and 3 can provide additional security if the programs providing them are secure. Option 4 is the simplest, is widely used, and is acceptable as long as the private key is appropriately protected.

Rationale

If the private key were to be disclosed, it could be used to decrypt all of the SSL communications with the web server as well as to impersonate the web server.

Impact

None documented

Audit Procedure

Perform the following steps to determine if the recommended state is implemented:

1. For each certificate file referenced in the Apache configuration files with the SSLCertificateFile directive, examine the file for a private key, clearly identified by the string PRIVATE KEY---.

2. For each file referenced in the Apache configuration files with the SSLCertificateKeyFile directive, verify the ownership is root:root and the permission 0400.

Remediation

Perform the following to implement the recommended state:

1. All private keys must be stored separately from the public certificates. Find all SSLCertificateFile directives in the Apache configuration files. For any SSLCertificateFile directives that do not have a corresponding separate SSLCertificateKeyFile directive, copy the key to a separate file from the certificate, and add the SSLCertificateKeyFile directive for the key file.

2. For each SSLCertificateKeyFile directive, change the ownership and permissions on the server private key to be owned by root:root with permission 0400.