Non-privileged accounts on the hosting system must only access OHS security-relevant information and functions through a distinct administrative account.

From Oracle HTTP Server 12.1.3 Security Technical Implementation Guide

Associated with: CCI-002235

SV-78993r1_rule Non-privileged accounts on the hosting system must only access OHS security-relevant information and functions through a distinct administrative account.

Vulnerability discussion

By separating web server security functions from non-privileged users, roles can be developed that can then be used to administer the web server. Forcing users to change from a non-privileged account to a privileged account when operating on the web server or on security-relevant information forces users to only operate as a web server administrator when necessary. Operating in this manner allows for better logging of changes and better forensic information and limits accidental changes to the web server.

Check content

1. Check that sudo is properly configured for the account owning the OHS software. 2. If accounts other than the account that owns the OHS software can access the OHS software, this is a finding.

Fix text

1. Configure sudo such that only the account that owns the OHS software can access it from the hosting system.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.