CIS Apache HTTP Server 2.4 Benchmark

Perform a security-focused planning review before any Apache installation addressing network placement, web content source, user access requirements, and module selection.

Without a structured pre-installation planning process, Apache HTTP Server deployments may be configured with unnecessary modules, excessive privileges, or improper network placement. A planning checklist ensures security considerations are addressed before the server enters production.

# Verify that a pre-installation planning document exists and covers:
# - Network placement and firewall rules
# - Required modules and features
# - User access requirements
# - Content source and ownership
# Review organizational documentation for the planning checklist.

# Create and complete a pre-installation planning checklist that addresses:
# 1. Network placement — place the Apache server in a DMZ or appropriate network segment
# 2. Module selection — enable only the modules required for the application
# 3. User accounts — define a dedicated non-privileged service account
# 4. Content source — identify and verify the origin of all web content
# 5. Access controls — define who requires administrative access and how it is granted
# Document and retain the completed checklist per organizational policy.

This recommendation verifies that the Server Is Not a Multi-Use System on the Apache HTTP Server 2.4 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to the Server Is Not a Multi-Use System may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify only necessary services are running:
ss -tlnp | grep -v httpd

Dedicate the system to the Apache web server role. Remove or disable all unnecessary services and applications.

This recommendation verifies that apache Is Installed from an Appropriate Source on the Apache HTTP Server 2.4 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to apache Is Installed from an Appropriate Source may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

httpd -v
rpm -qi httpd 2>/dev/null || dpkg -s apache2 2>/dev/null

Install Apache from official OS vendor repositories or compile from the verified Apache HTTP Server source at https://httpd.apache.org.

This recommendation verifies that the Latest Security Patches Are Applied on the Apache HTTP Server 2.4 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to the Latest Security Patches Are Applied may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

httpd -v
# Compare version against https://httpd.apache.org/security/vulnerabilities_24.html

dnf update httpd
# or
apt upgrade apache2

This setting controls whether Only Necessary Authentication and Authorization Modules is enabled on the Apache HTTP Server 2.4 web server. Enabling this feature strengthens the security posture by enforcing the recommended configuration via httpd.conf, apache2.conf, or site configuration files.

Without Only Necessary Authentication and Authorization Modules enabled, the Apache HTTP Server 2.4 web server may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

httpd -M 2>/dev/null | grep -E 'auth|access'
# or
apache2ctl -M 2>/dev/null | grep -E 'auth|access'

Disable unnecessary auth modules by commenting out the LoadModule directive in the httpd.conf or removing the symlink from mods-enabled/.

This setting controls whether the Log Config Module is enabled on the Apache HTTP Server 2.4 web server. Enabling this feature strengthens the security posture by enforcing the recommended configuration via httpd.conf, apache2.conf, or site configuration files.

Without the Log Config Module enabled, the Apache HTTP Server 2.4 web server may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

httpd -M 2>&1 | grep log_config
# Should show: log_config_module (shared)

# httpd.conf:
LoadModule log_config_module modules/mod_log_config.so

This setting controls whether mod_dav is disabled on the Apache HTTP Server 2.4 web server. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving mod_dav enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Apache HTTP Server 2.4 web server.

httpd -M 2>&1 | grep dav
# Should return empty

# Comment out in httpd.conf:
# LoadModule dav_module modules/mod_dav.so
# LoadModule dav_fs_module modules/mod_dav_fs.so

This setting controls whether mod_status is disabled on the Apache HTTP Server 2.4 web server. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving mod_status enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Apache HTTP Server 2.4 web server.

httpd -M 2>&1 | grep status_module
# Should return empty

# Comment out:
# LoadModule status_module modules/mod_status.so

This setting controls whether mod_autoindex is disabled on the Apache HTTP Server 2.4 web server. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving mod_autoindex enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Apache HTTP Server 2.4 web server.

httpd -M 2>&1 | grep autoindex
# Should return empty

# Comment out:
# LoadModule autoindex_module modules/mod_autoindex.so

This setting enforces that mod_proxy Is Disabled If Not is required on the Apache HTTP Server 2.4 web server. Making this mandatory ensures consistent security policy enforcement across the environment.

Failure to mod_proxy Is Disabled If Not Required may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

httpd -M 2>&1 | grep proxy

# If not needed, comment out all proxy modules:
# LoadModule proxy_module modules/mod_proxy.so
# LoadModule proxy_http_module modules/mod_proxy_http.so

This setting controls whether mod_info is disabled on the Apache HTTP Server 2.4 web server. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving mod_info enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Apache HTTP Server 2.4 web server.

httpd -M 2>&1 | grep info_module
# Should return empty

# Comment out:
# LoadModule info_module modules/mod_info.so

This setting controls whether mod_userdir is disabled on the Apache HTTP Server 2.4 web server. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving mod_userdir enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Apache HTTP Server 2.4 web server.

httpd -M 2>&1 | grep userdir

# Comment out:
# LoadModule userdir_module modules/mod_userdir.so

This recommendation verifies that apache Runs as a Non-Root User on the Apache HTTP Server 2.4 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to apache Runs as a Non-Root User may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^User|^Group' /etc/httpd/conf/httpd.conf
# Should not be root
ps -ef | grep httpd | grep -v grep

# httpd.conf:
User apache
Group apache

This recommendation verifies that the Apache User Account Has an Invalid Shell on the Apache HTTP Server 2.4 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to the Apache User Account Has an Invalid Shell may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep apache /etc/passwd
# Shell should be /sbin/nologin or /usr/sbin/nologin

usermod -s /sbin/nologin apache

This recommendation verifies that the Apache User Account Is Locked on the Apache HTTP Server 2.4 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to the Apache User Account Is Locked may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

passwd -S apache
# Should show 'L' (locked)

passwd -l apache

The ownership of Apache Directories Are should be set to Root. Correct file and directory ownership prevents unauthorized modification and maintains the integrity of the Apache HTTP Server 2.4 web server configuration.

Incorrect ownership of Apache Directories Are may allow unauthorized users to modify critical configuration or executable files. Ensuring correct ownership is essential for maintaining the integrity of the Apache HTTP Server 2.4 web server.

stat -c '%U:%G' /etc/httpd /etc/httpd/conf /etc/httpd/conf.d
# Should be root:root

chown -R root:root /etc/httpd/conf /etc/httpd/conf.d

This recommendation verifies that the Document Root Directory Has Appropriate Permissions on the Apache HTTP Server 2.4 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to the Document Root Directory Has Appropriate Permissions may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U:%G' /var/www/html
# Permissions should be 755 or more restrictive

chmod 755 /var/www/html
chown root:root /var/www/html

This recommendation verifies that the Core Dump Directory Is Secured on the Apache HTTP Server 2.4 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to the Core Dump Directory Is Secured may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep CoreDumpDirectory /etc/httpd/conf/httpd.conf
# Should not be set, or set to a restricted directory

Ensure CoreDumpDirectory is not configured, or points to a root-owned directory with 700 permissions.

This recommendation verifies that lock File Is Secured on the Apache HTTP Server 2.4 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to lock File Is Secured may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep LockFile /etc/httpd/conf/httpd.conf
# Default location /run/httpd/ is typically secure

Ensure the LockFile (or Mutex directive) stores lock files in a directory writable only by root.

This recommendation addresses the proper configuration of the Error Log on the Apache HTTP Server 2.4 web server. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of the Error Log can lead to security gaps that may be exploited by attackers. A properly configured Apache HTTP Server 2.4 web server reduces exposure to both known vulnerabilities and configuration drift.

grep '^ErrorLog' /etc/httpd/conf/httpd.conf
# Should point to a valid log path

# httpd.conf:
ErrorLog "logs/error_log"
LogLevel warn

This recommendation configures LogLevel to at Least 'notice' for Core on the Apache HTTP Server 2.4 web server. Setting this value appropriately ensures the system operates within the security parameters defined by the CIS benchmark.

An improperly configured value for LogLevel could weaken security controls or allow unintended behavior. Setting this to at Least 'notice' for Core ensures the Apache HTTP Server 2.4 web server operates within a well-defined security boundary.

grep LogLevel /etc/httpd/conf/httpd.conf

LogLevel notice core:info

This recommendation addresses the proper configuration of the Access Log on the Apache HTTP Server 2.4 web server. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of the Access Log can lead to security gaps that may be exploited by attackers. A properly configured Apache HTTP Server 2.4 web server reduces exposure to both known vulnerabilities and configuration drift.

grep -E '^CustomLog|^TransferLog' /etc/httpd/conf/httpd.conf

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
CustomLog "logs/access_log" combined

This recommendation verifies that log Files Are Rotated on the Apache HTTP Server 2.4 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to log Files Are Rotated may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

cat /etc/logrotate.d/httpd

# /etc/logrotate.d/httpd:
/var/log/httpd/*log {
    daily
    missingok
    rotate 52
    compress
    notifempty
    postrotate
        /bin/systemctl reload httpd.service > /dev/null 2>&1 || true
    endscript
}

This recommendation verifies that mod_security Is Installed and Enabled on the Apache HTTP Server 2.4 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to mod_security Is Installed and Enabled may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

httpd -M 2>&1 | grep security
# Should show: security2_module

dnf install mod_security mod_security_crs
# or
apt install libapache2-mod-security2

This recommendation verifies that the Default Deny Directive Is Set for the OS Root Directory on the Apache HTTP Server 2.4 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to the Default Deny Directive Is Set for the OS Root Directory may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -A4 '<Directory />' /etc/httpd/conf/httpd.conf

<Directory />
    AllowOverride None
    Require all denied
</Directory>

This setting ensures that Options for the OS Root Directory is restricted on the Apache HTTP Server 2.4 web server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted Options for the OS Root Directory could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Apache HTTP Server 2.4 web server is essential for defense in depth.

grep -A5 '<Directory />' /etc/httpd/conf/httpd.conf | grep Options

<Directory />
    Options None
    AllowOverride None
    Require all denied
</Directory>

This setting controls whether FollowSymLinks is disabled on the Apache HTTP Server 2.4 web server. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving FollowSymLinks enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Apache HTTP Server 2.4 web server.

grep -r 'Options.*FollowSymLinks' /etc/httpd/
# Should not appear without SymLinksIfOwnerMatch

# Replace FollowSymLinks with SymLinksIfOwnerMatch in all Options directives:
Options -FollowSymLinks +SymLinksIfOwnerMatch

This recommendation configures AllowOverride to None for Root on the Apache HTTP Server 2.4 web server. Setting this value appropriately ensures the system operates within the security parameters defined by the CIS benchmark.

An improperly configured value for AllowOverride could weaken security controls or allow unintended behavior. Setting this to None for Root ensures the Apache HTTP Server 2.4 web server operates within a well-defined security boundary.

grep -r 'AllowOverride' /etc/httpd/conf/httpd.conf

# For OS root and Apache root:
AllowOverride None

This recommendation verifies that .htaccess Files Are Restricted If Used on the Apache HTTP Server 2.4 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to .htaccess Files Are Restricted If Used may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

find /var/www -name '.htaccess' -exec ls -la {} \;
grep -r 'AccessFileName' /etc/httpd/conf/httpd.conf

When AllowOverride is None, .htaccess files are ignored. If required, restrict AllowOverride to only the directives needed.

This recommendation verifies that mod_ssl or mod_nss Is Installed on the Apache HTTP Server 2.4 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to mod_ssl or mod_nss Is Installed may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

httpd -M 2>&1 | grep ssl_module

dnf install mod_ssl
# or
a2enmod ssl

This recommendation configures SSLProtocol to TLSv1.2 or Higher on the Apache HTTP Server 2.4 web server. Setting this value appropriately ensures the system operates within the security parameters defined by the CIS benchmark.

An improperly configured value for SSLProtocol could weaken security controls or allow unintended behavior. Setting this to TLSv1.2 or Higher ensures the Apache HTTP Server 2.4 web server operates within a well-defined security boundary.

grep -r SSLProtocol /etc/httpd/conf.d/ssl.conf

SSLProtocol -all +TLSv1.2 +TLSv1.3

This recommendation verifies that sSLCipherSuite Is Configured for Strong Ciphers on the Apache HTTP Server 2.4 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to sSLCipherSuite Is Configured for Strong Ciphers may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep SSLCipherSuite /etc/httpd/conf.d/ssl.conf

SSLCipherSuite HIGH:!aNULL:!MD5:!3DES:!RC4:!DES:!EXPORT
SSLHonorCipherOrder on

This setting controls whether SSL Compression is disabled on the Apache HTTP Server 2.4 web server. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving SSL Compression enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Apache HTTP Server 2.4 web server.

grep SSLCompression /etc/httpd/conf.d/ssl.conf

SSLCompression off

This setting controls whether HSTS is enabled on the Apache HTTP Server 2.4 web server. Enabling this feature strengthens the security posture by enforcing the recommended configuration via httpd.conf, apache2.conf, or site configuration files.

Without HSTS enabled, the Apache HTTP Server 2.4 web server may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

grep 'Strict-Transport-Security' /etc/httpd/conf/httpd.conf /etc/httpd/conf.d/*.conf

# Requires mod_headers:
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

This setting controls whether OCSP Stapling is enabled on the Apache HTTP Server 2.4 web server. Enabling this feature strengthens the security posture by enforcing the recommended configuration via httpd.conf, apache2.conf, or site configuration files.

Without OCSP Stapling enabled, the Apache HTTP Server 2.4 web server may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

grep SSLUseStapling /etc/httpd/conf.d/ssl.conf

SSLUseStapling on
SSLStaplingCache shmcb:/run/httpd/ssl_stapling(128000)

This recommendation configures ServerTokens to 'Prod' on the Apache HTTP Server 2.4 web server. Setting this value appropriately ensures the system operates within the security parameters defined by the CIS benchmark.

An improperly configured value for ServerTokens could weaken security controls or allow unintended behavior. Setting this to 'Prod' ensures the Apache HTTP Server 2.4 web server operates within a well-defined security boundary.

grep ServerTokens /etc/httpd/conf/httpd.conf
# Should be: ServerTokens Prod

ServerTokens Prod

This setting controls whether ServerSignature is disabled on the Apache HTTP Server 2.4 web server. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving ServerSignature enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Apache HTTP Server 2.4 web server.

grep ServerSignature /etc/httpd/conf/httpd.conf

ServerSignature Off

This recommendation verifies that custom Error Pages Are Defined on the Apache HTTP Server 2.4 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to custom Error Pages Are Defined may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep ErrorDocument /etc/httpd/conf/httpd.conf

ErrorDocument 404 /errors/404.html
ErrorDocument 500 /errors/500.html

This recommendation verifies that eTag Header Is Configured to Prevent Information Leakage on the Apache HTTP Server 2.4 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to eTag Header Is Configured to Prevent Information Leakage may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep FileETag /etc/httpd/conf/httpd.conf

FileETag MTime Size

This recommendation configures the Timeout Directive to 10 Seconds or Less on the Apache HTTP Server 2.4 web server. Setting this value appropriately ensures the system operates within the security parameters defined by the CIS benchmark.

An improperly configured value for the Timeout Directive could weaken security controls or allow unintended behavior. Setting this to 10 Seconds or Less ensures the Apache HTTP Server 2.4 web server operates within a well-defined security boundary.

grep '^Timeout' /etc/httpd/conf/httpd.conf

Timeout 10

This setting controls whether KeepAlive is enabled on the Apache HTTP Server 2.4 web server. Enabling this feature strengthens the security posture by enforcing the recommended configuration via httpd.conf, apache2.conf, or site configuration files.

Without KeepAlive enabled, the Apache HTTP Server 2.4 web server may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

grep KeepAlive /etc/httpd/conf/httpd.conf

KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 5

This recommendation verifies that the RequestReadTimeout Directive Is Set on the Apache HTTP Server 2.4 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to the RequestReadTimeout Directive Is Set may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

httpd -M 2>&1 | grep reqtimeout
grep RequestReadTimeout /etc/httpd/conf/httpd.conf

# Requires mod_reqtimeout:
RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500

This recommendation verifies that limitRequestLine and LimitRequestFields Are Set on the Apache HTTP Server 2.4 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to limitRequestLine and LimitRequestFields Are Set may leave the Apache HTTP Server 2.4 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E 'LimitRequestLine|LimitRequestFields|LimitRequestFieldSize|LimitRequestBody' /etc/httpd/conf/httpd.conf

LimitRequestLine 512
LimitRequestFields 100
LimitRequestFieldSize 1024
LimitRequestBody 102400