Section 1.1 Harden Underlying Operating System
[FAILED] Has the Operating System been hardened according to any and all applicable OS system security benchmark guidance? (Answer: No)
Section 1.2 Create the Web Groups
[FAILED] Created three dedicated web groups? (Answer: No)
Section 1.3 Create the Apache Web User Account
[FAILED] User "" does not exist on the system.
Section 1.4 Lock Down the Apache Web User Account
[FAILED] No shell specified for "".
Section 1.5 Apache Distribution Download
[FAILED] Downloaded the Apache source and MD5 Checksums from httpd.apache.org? (Answer: No)
Section 1.6 Verify the MD5 Checksums
[FAILED] Verified the Apache MD5 Checksums? (Answer: No)
Section 1.7 Apply Current Patches (Applicable to your OS Platform and Apache Version)
[FAILED] Applied the current distribution patches? (Answer: No)
Section 1.8 Update the Apache Banner Information
[FAILED] Apache banner "Apache/2.0.50 (Unix) PHP/4.3.11" not sufficiently altered. Either edit the httpd.h file or implement the Mod_Security SecServerSignature Directive.
Section 1.9 Configure the Apache Software
[FAILED] "mod_headers.c" should be compiled into Apache.
[FAILED] Unless required, module "mod_imap.c" should not be compiled into Apache.
[FAILED] Unless required, module "mod_autoindex.c" should not be compiled into Apache.
[FAILED] Unless required, module "mod_status.c" should not be compiled into Apache.
[FAILED] "mod_rewrite.c" should be compiled into Apache.
[FAILED] "mod_auth_digest.c" should be compiled into Apache.
[FAILED] Unless required, module "mod_userdir.c" should not be compiled into Apache.
[FAILED] "mod_vhost_alias.c" should be compiled into Apache.
Section 1.10 Compile and Install the Apache Software
[PASSED] Compiled and installed Apache distribution? (Answer: Yes)
Section 1.11 Server Oriented General Directives
[PASSED] Server type is "standalone"
[FAILED] HostnameLookups is off
Section 1.12 User Oriented General Directives
[PASSED] User is ""
[PASSED] Group is ""
[FAILED] Is the you@example.com address a valid email alias? (Answer: No)
Section 1.13 Denial of Service (DoS) Protective General Directives
[FAILED] TimeOut value "300" is greater than the recommended "60"
[PASSED] KeepAlive value is "On"
[FAILED] KeepAliveTimeout value of "30" is greater than the recommended "15"
[FAILED] StartServers value of "5" is less than the recommended "10"
[PASSED] MinSpareServers is "5"
[PASSED] MaxSpareServers is "10"
[PASSED] MaxClients is "256"
Section 1.14 Web Server Software Obfuscation General Directives
[FAILED] ServerTokens is "Full"
[FAILED] ServerSignature is "On"
[FAILED] ErrorDocument is not set for status code "400".
[FAILED] ErrorDocument is not set for status code "401".
[FAILED] ErrorDocument is not set for status code "403".
[FAILED] ErrorDocument is not set for status code "404".
[FAILED] ErrorDocument is not set for status code "405".
[FAILED] ErrorDocument is not set for status code "500".
Section 1.15 Web Server Fingerprinting
[FAILED] No fake headers have been specified.
Section 1.16 Intrusion Detection Options
[FAILED] Are fake CGI scripts used? (Answer: No)
[FAILED] LocationMatch is not used to limit scans
[FAILED] ScriptAliasMatch is not used
Section 1.17 Mod_Security
[FAILED] Module mod_security is not compiled into apache binary.
Section 1.18 Access Control Directives
[FAILED] Directory entry for "/" is not properly configured.
Section 1.19 Authentication Mechanisms
[FAILED] Have you implemented SSL to encrypt the Basic Auth Session? (Answer: No)
Section 1.20 Directory Functionality/Features Directives
[FAILED] Did not disable Option directive "Includes" for directory "/var/www//htdocs".
[FAILED] Did not disable Option directive "MultiViews" for directory "/var/www//htdocs".
[FAILED] Remove Option directive "Indexes" for directory "/var/www//htdocs" unless required.
[FAILED] Remove Option directive "FollowSymLinks" for directory "/var/www//htdocs" unless required.
Section 1.21 Limiting HTTP Request Methods
[FAILED] LimitExcept directive on "/var/www//htdocs" is not properly set for GET and POST.
Section 1.22 Logging General Directives
[FAILED] LogLevel is set to "warn".
Section 1.23 Remove Default/Unneeded Apache Files
[VERIFY] Verify DocumentRoot "/var/www//htdocs" files (37) are not default Apache files.
[SKIPPED] User "" home directory () does not exist.
Section 1.24 Update Ownership and Permissions for Enhanced Security
[PASSED] Owner of Server Conf directory "/var/www//conf/" is root.
[VERIFY] Server Conf directory "/var/www//conf/" group is properly set.
[FAILED] Permissions on Server Conf directory "/var/www//conf/" should be "660".
[FAILED] Group "" does not exist on the system.
[FAILED] Permissions on Document Root "/var/www//htdocs" should be "664".
[FAILED] Owner of Document Root "/var/www//htdocs" should be root.
[FAILED] Log directory "logs" does not exist.
[FAILED] CGI directory "" does not exist.
[VERIFY] Server Bin directory "/var/www//bin/" group is properly set.
[FAILED] Permissions on Server Bin directory "/var/www//bin/" should be "550".
[PASSED] Owner of Server Bin directory "/var/www//bin/" is root.
Section 1.25 Update the Apachectl Script for Email Notification
[FAILED] Updated the default apachectl start script's code to send alerts to the appropriate personnel? (Answer: No)
Apache Benchmark Tool Results Apache Configuration File: /var/www/conf/httpd.conf
Benchark Score: 1.45 out of 10.00
Thursday, April 19th 2007 at 11:06:54 A.M.