IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
the system by the manufacturer should be entirely removed, because errors
have repeatedly appeared in these programs in the past.
The directory in which the retrievable files are stored should be located on a
separate partition of a hard disk so as to make it easier to restore it after a hard
disk defect. Moreover, the subdirectories and files should belong to a specific
user (for example wwwadmin) and be protected against unauthorised access by
being given minimum access rights.
During configuration of an HTTP server, a number of options should be taken
into account which are relevant to security. These include, for example:
- Listing directory contents
This option should be deactivated. If the complete contents of a directory
are disclosed to the outside, it is often the case that too much information is
divulged. This is dangerous in particular if the directory contains files
whose existence is not supposed to be made known externally, i.e.
password files, for example, or files that are not generally accessible. It is
better to use index files in order to make the contents of directories known
externally.
- Use of symbolic links
This option should be deactivated, because symbolic links can be used to
gain access to files outside the approved Web directory. During the
configuration of the server, the area which the server is allowed to access
in order to disseminate files via HTTP is specified as the DocumentRoot.
Files outside the DocumentRoot and the cgi-bin directory are not
disseminated, even if the HTTP daemon possesses read rights.
If it is necessary to make the same document accessible via various URLs,
it is more advisable to use the route via a Redirect in the .htaccess file.
- Anonymous use of the server
Even if user-defined access protection is set up on a WWW server, it is
often also desirable to grant access to new, as yet unknown users, i.e. to
new customers, for example. Provision can be made for anonymous access
for this purpose. To gain access, a user can either not log in at all or log in
with his or her e-mail address as the password. If this is wrongly
configured, however, the entire contents of the server may be freely
available as a result. This option should therefore be used with particular
caution.
The following checklist is recommended:
1. Are only necessary components installed? It is advisable to compile the
http daemon yourself; in that way, unnecessary functions will not be
compiled in the first place.
2. Is the http daemon configured to be as restrictive as possible? Either cgi
programs should be entirely disabled, therefore, or the cgi programs should
be restricted to their own directory. File access by the http daemon should
be limited to part of the directory tree. Separate, unprivileged user rights
should be used for administration and operation of the server.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000