- Community Home
- >
- Servers and Operating Systems
- >
- Operating Systems
- >
- Operating System - OpenVMS
- >
- Re: Securing HP SWS Apache to DoD DISA STIG
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Forums
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО02-10-2011 04:37 PM
тАО02-10-2011 04:37 PM
Securing HP SWS Apache to DoD DISA STIG
I would like to not have to reinvent the wheel if someone else has done this.
Thanks,
Cass
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО02-11-2011 03:06 PM
тАО02-11-2011 03:06 PM
Re: Securing HP SWS Apache to DoD DISA STIG
Rick Retterer here. Can you drop me an email on this please?
We received an inquiry from the Engineering Management staff on this yesterday...
Cheers,
Rick
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО02-11-2011 05:36 PM
тАО02-11-2011 05:36 PM
Re: Securing HP SWS Apache to DoD DISA STIG
To save you the digging...
CSWS/SWS/Apache is built from 2.0.52
Apache 2.2.17 and 2.0.64 are current
csws_php is built from 5.2.13
php 5.3.5 and 5.2.17 are current
(support for php prior to 5.3 has ended)
csws_perl is built from 5.8-6
perl is at 5.12.13
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО02-14-2011 10:59 AM
тАО02-14-2011 10:59 AM
Re: Securing HP SWS Apache to DoD DISA STIG
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО02-14-2011 12:43 PM
тАО02-14-2011 12:43 PM
Re: Securing HP SWS Apache to DoD DISA STIG
Have a look at http://labs.hoffmanlabs.com/node/43 for some links and pointers, including to NIST's SP800-44v2, to the VMS SRR, and AS-816.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО02-14-2011 01:26 PM
тАО02-14-2011 01:26 PM
Re: Securing HP SWS Apache to DoD DISA STIG
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО02-17-2011 06:18 AM
тАО02-17-2011 06:18 AM
Re: Securing HP SWS Apache to DoD DISA STIG
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО02-17-2011 09:11 AM
тАО02-17-2011 09:11 AM
Re: Securing HP SWS Apache to DoD DISA STIG
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО02-17-2011 09:20 AM
тАО02-17-2011 09:20 AM
Re: Securing HP SWS Apache to DoD DISA STIG
For example the current setup for Apache on OpenVMS is to have the APACHE$WWW user be the owner of the processes that run the web services executables and the APACHE$WWW user also owns the HTTPD.CONF and other configuration files.
The fear is if someone can cause the webservice process to change the HTTPD.CONF file then they would control your web server.
Is this a valid concern?
If not please explain why.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО02-17-2011 09:24 AM
тАО02-17-2011 09:24 AM
Re: Securing HP SWS Apache to DoD DISA STIG
So for example, the http.conf file will have an identifier that allows APACHE to READ it.