cis-apache-http-server-2_2.yaml

benchmark:
  id: apache-http-server-2-4
  name: CIS Apache HTTP Server 2.4 Benchmark
  version: v1.4.0 - 03-20-2018
controls:
  - id: 2.2
    name: Check the Log Config Module is enabled
    description:
      The log_config module provides for flexible logging of client requests and provides
      for the configuration of the information in each log.
    rationale:
      Logging is critical for monitoring usage and potential abuse of your web server.
      This module is required to configure web server logging using the log_format directive.
    impact: 1.0
    command: /usr/sbin/httpd -M | grep -q log_config
  - id: 3.2
    name: Give the Apache User Account an Invalid Shell
    description:
      The apache account must not be used as a regular login account and should be assigned
      an invalid or nologin shell to ensure that the account cannot be used to login.
    rationale:
      Service accounts such as the apache account represent a risk if they can be used
      to get a login shell to the system.
    impact: 1.0
    command: 'awk -F:  ''$1 == "apache" {print $7 }'' /etc/passwd | grep -q ''/sbin/nologin'''