cis-apache-7-9

name	cis-apache-7.9
description	Ensure All Web Content is Accessed via HTTPS
category	cis-apache
version	3.6.0
author	cyberstrike-official
tags	["cis","apache","linux","ssl","tls","https","encryption","redirect"]
cis_id	7.9
cis_benchmark	CIS Apache HTTP Server 2.2 Benchmark v3.6.0
tech_stack	["linux","apache"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure All Web Content is Accessed via HTTPS

Description

All of the website content should be served via HTTPS rather than HTTP. A redirect from the HTTP website to the HTTPS content is often useful and is recommended, but all significant content should be accessed via HTTPS so that it is authenticated and encrypted.

Rationale

The usage of clear text HTTP prevents the client browser from authenticating the connection and ensuring the integrity of the website information. Without the HTTPS authentication, a client may be subjected to a variety of man-in-the-middle and spoofing attacks which would cause them to receive modified web content which could harm the organization's reputation. Through DNS attacks or malicious redirects, the client could arrive at a malicious website instead of the intended website. The malicious website could deliver malware, request credentials, or deliver false information.

Audit

Perform the following to determine if the recommended state is implemented:

• Gather the list of listening IP addresses from the Apache configuration files. The commands below may be used to extract the relevant IP addresses from the configuration files. The CONF_DIRS variable needs to be set to the list of directories that contain all of the Apache configuration files.

## Replace the following directory list with the appropriate list.
CONF_DIRS="/etc/httpd/conf /etc/httpd/conf.d /etc/httpd/conf_dir2 . . .
"
CONFS=$(find $CONF_DIRS -type f -name '*.conf' )
## Search for Listen directives that are not port :443 or https
IPS=$(egrep -ih '^\s*Listen ' $CONFS | egrep -iv '(:443\b)|https' | cut
-d' ' -f2)

• Gather the list of virtual host names from the Apache configuration files. The commands below can be used to extract the relevant virtual host names from the configuration files listed in $CONFS. The resulting list will include all virtual hosts not running on port :443. Although some listed virtual hosts may be TLS enabled, but on a non-standard port. Such websites will return an error rather than HTML content, as shown in the final steps.

## Get host names and ports of all of the virtual hosts
VHOSTS=$(egrep -iho '^\s*<VirtualHost .*>' $CONFS | egrep -io '\s+[A-
Z:.0-9]+\+$' | \
    tr -d ' >')

• For each of the IP address and virtual hosts name, prefix the IP address or host name with the http:// protocol, and add the / slash as well.

URLS=$(for h in $LIPADDR $VHOSTS ; do echo "http://$h/"; done)

• Check to ensure each URL does not deliver significate web content via the HTTP protocol. The URL's may be manually entered in a browser for testing, or may be scripted with a command line web client such as curl, as shown below.

## For each of the URL's test with curl, and truncate the output to 300
characters
for u in $URLS ; do echo -e "\n\n\n==== $u ===="; curl -fSs $u | head -c
300 ; done