Securing HP SWS Apache to DoD DISA STIG

[Cass Witkowski]

I'm looking for anyone who has had to secure HP's SWS running on OpenVMS Itanium to satisfy the DoD DISA STIG.

I would like to not have to reinvent the wheel if someone else has done this.

Thanks,

Cass

[Rick Retterer]

Cass,

Rick Retterer here. Can you drop me an email on this please?

We received an inquiry from the Engineering Management staff on this yesterday...

Cheers,
Rick

[Hoff]

This is going to be an interesting review project.

To save you the digging...

CSWS/SWS/Apache is built from 2.0.52
Apache 2.2.17 and 2.0.64 are current

csws_php is built from 5.2.13
php 5.3.5 and 5.2.17 are current
(support for php prior to 5.3 has ended)

csws_perl is built from 5.8-6
perl is at 5.12.13

[Cass Witkowski]

Hoff, Why did you say that this would be an interesting review project? Have you done this before?

[Hoff]

This project will be "interesting" because these software versions are old, and there are known issues with various of them.

Have a look at http://labs.hoffmanlabs.com/node/43 for some links and pointers, including to NIST's SP800-44v2, to the VMS SRR, and AS-816.

[Cass Witkowski]

True the age of the software affects some of the issues with securing but most of what needs to be addressed is applicable to all version.

[Peter Barkas]

Indeed it will be an interesting review particularly if HP actually updates any of the aforementioned software or indeed releases a version of CSWS that is compatible with SSL V1.4.

[Cass Witkowski]

From what I hear look in early Q3 for a new version of OpenSSL

[Cass Witkowski]

Alot of the DISA STIG findings are related to who owns the files in the Apache directory tree versus who is running the webservices.

For example the current setup for Apache on OpenVMS is to have the APACHE$WWW user be the owner of the processes that run the web services executables and the APACHE$WWW user also owns the HTTPD.CONF and other configuration files.

The fear is if someone can cause the webservice process to change the HTTPD.CONF file then they would control your web server.

Is this a valid concern?

If not please explain why.

[Peter Barkas]

My understanding is that OpenVMS APACHE (CSWS) has access to nothing unless it is granted access.

So for example, the http.conf file will have an identifier that allows APACHE to READ it.