The Apache web server must restrict the ability of users to launch denial-of-service (DoS) attacks against other information systems or networks.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-214338 | SRG-APP-000246-WSR-000149 | AS24-W1-000590 | SV-214338r1192947_rule | 2026-02-25 | 3 |
Description
Apache web server can limit the ability of the web server being used in a DoS attack through several methods. The methods employed will depend upon the hosted applications and their resource needs for proper operation.
A DoS can occur when the Apache web server is so overwhelmed that it can no longer respond to additional requests. A web server not properly tuned may become overwhelmed and cause a DoS condition even with expected traffic from users.
To avoid a DoS, the Apache web server must be tuned to handle the expected traffic for the hosted applications.
Satisfies: SRG-APP-000246-WSR-000149, SRG-APP-000435-WSR-000148
ℹ️ Check
Review the <'INSTALLED PATH'>\conf\httpd.conf file.
Verify the "Timeout" directive is specified in the "httpd.conf" file to have a value of "60" seconds or less.
If the "Timeout" directive is not configured or set for more than "60" seconds, this is a finding.
✔️ Fix
Review the <'INSTALLED PATH'>\conf\httpd.conf file.
Add or modify the "Timeout" directive in the Apache configuration to have a value of "60" seconds or less.
"Timeout 60"
Restart the Apache service.