All accounts installed with the Apache web server software and tools must have passwords assigned and default passwords changed.

From Apache Server 2.4 UNIX Server Security Technical Implementation Guide

Associated with: CCI-000366

AS24-U1-000940_rule All accounts installed with the Apache web server software and tools must have passwords assigned and default passwords changed.

Vulnerability discussion

During installation of the Apache web server software, accounts are created for the Apache web server to operate properly. The accounts installed can have either no password installed or a default password, which will be known and documented by the vendor and the user community.The first things an attacker will try when presented with a logon screen are the default user identifiers with default passwords. Installed applications may also install accounts with no password, making the logon even easier. Once the Apache web server is installed, the passwords for any created accounts should be changed and documented. The new passwords must meet the requirements for all passwords, i.e., upper/lower characters, numbers, special characters, time until change, reuse policy, etc. Service accounts or system accounts that have no logon capability do not need to have passwords set or changed.

Check content

Review the configured users. If the default "apache" user is being used to run Apache, this is a finding.

Fix text

Create a new non-privileged account to run the Apache processes through.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.