Section 1.1 Harden Underlying Operating System
[FAILED]  Has the Operating System been hardened according to any and all applicable OS system security benchmark guidance? (Answer: No)  

Section 1.2 Create the Web Groups
[FAILED]  Created three dedicated web groups? (Answer: No)  

Section 1.3 Create the Apache Web User Account
[FAILED]  User "" does not exist on the system.  

Section 1.4 Lock Down the Apache Web User Account
[FAILED]  No shell specified for "".  

Section 1.5 Apache Distribution Download
[FAILED]  Downloaded the Apache source and MD5 Checksums from httpd.apache.org? (Answer: No)  

Section 1.6 Verify the MD5 Checksums
[FAILED]  Verified the Apache MD5 Checksums? (Answer: No)  

Section 1.7 Apply Current Patches (Applicable to your OS Platform and Apache Version)
[FAILED]  Applied the current distribution patches? (Answer: No)  

Section 1.8 Update the Apache Banner Information
[FAILED]  Apache banner "Apache/2.0.50 (Unix) PHP/4.3.11" not sufficiently altered. Either edit the httpd.h file or implement the Mod_Security SecServerSignature Directive.  

Section 1.9 Configure the Apache Software
[FAILED]  "mod_headers.c" should be compiled into Apache.  
[FAILED]  Unless required, module "mod_imap.c" should not be compiled into Apache.  
[FAILED]  Unless required, module "mod_autoindex.c" should not be compiled into Apache.  
[FAILED]  Unless required, module "mod_status.c" should not be compiled into Apache.  
[FAILED]  "mod_rewrite.c" should be compiled into Apache.  
[FAILED]  "mod_auth_digest.c" should be compiled into Apache.  
[FAILED]  Unless required, module "mod_userdir.c" should not be compiled into Apache.  
[FAILED]  "mod_vhost_alias.c" should be compiled into Apache.  

Section 1.10 Compile and Install the Apache Software
[PASSED]  Compiled and installed Apache distribution? (Answer: Yes)  

Section 1.11 Server Oriented General Directives
[PASSED]  Server type is "standalone"  
[FAILED]  HostnameLookups is off  

Section 1.12 User Oriented General Directives
[PASSED]  User is ""  
[PASSED]  Group is ""  
[FAILED]  Is the you@example.com address a valid email alias? (Answer: No)  

Section 1.13 Denial of Service (DoS) Protective General Directives
[FAILED]  TimeOut value "300" is greater than the recommended "60"  
[PASSED]  KeepAlive value is "On"  
[FAILED]  KeepAliveTimeout value of "30" is greater than the recommended "15"  
[FAILED]  StartServers value of "5" is less than the recommended "10"  
[PASSED]  MinSpareServers is "5"  
[PASSED]  MaxSpareServers is "10"  
[PASSED]  MaxClients is "256"  

Section 1.14 Web Server Software Obfuscation General Directives
[FAILED]  ServerTokens is "Full"  
[FAILED]  ServerSignature is "On"  
[FAILED]  ErrorDocument is not set for status code "400".  
[FAILED]  ErrorDocument is not set for status code "401".  
[FAILED]  ErrorDocument is not set for status code "403".  
[FAILED]  ErrorDocument is not set for status code "404".  
[FAILED]  ErrorDocument is not set for status code "405".  
[FAILED]  ErrorDocument is not set for status code "500".  

Section 1.15 Web Server Fingerprinting
[FAILED]  No fake headers have been specified.  

Section 1.16 Intrusion Detection Options
[FAILED]  Are fake CGI scripts used? (Answer: No)  
[FAILED]  LocationMatch is not used to limit scans  
[FAILED]  ScriptAliasMatch is not used  

Section 1.17 Mod_Security
[FAILED]  Module mod_security is not compiled into apache binary.  

Section 1.18 Access Control Directives
[FAILED]  Directory entry for "/" is not properly configured.  

Section 1.19 Authentication Mechanisms
[FAILED]  Have you implemented SSL to encrypt the Basic Auth Session? (Answer: No)  

Section 1.20 Directory Functionality/Features Directives
[FAILED]  Did not disable Option directive "Includes" for directory "/var/www//htdocs".  
[FAILED]  Did not disable Option directive "MultiViews" for directory "/var/www//htdocs".  
[FAILED]  Remove Option directive "Indexes" for directory "/var/www//htdocs" unless required.  
[FAILED]  Remove Option directive "FollowSymLinks" for directory "/var/www//htdocs" unless required.  

Section 1.21 Limiting HTTP Request Methods
[FAILED]  LimitExcept directive on "/var/www//htdocs" is not properly set for GET and POST.  

Section 1.22 Logging General Directives
[FAILED]  LogLevel is set to "warn".  

Section 1.23 Remove Default/Unneeded Apache Files
[VERIFY]  Verify DocumentRoot "/var/www//htdocs" files (37) are not default Apache files.  
[SKIPPED]  User "" home directory () does not exist.  

Section 1.24 Update Ownership and Permissions for Enhanced Security
[PASSED]  Owner of Server Conf directory "/var/www//conf/" is root.  
[VERIFY]  Server Conf directory "/var/www//conf/" group is properly set.  
[FAILED]  Permissions on Server Conf directory "/var/www//conf/" should be "660".  
[FAILED]  Group "" does not exist on the system.  
[FAILED]  Permissions on Document Root "/var/www//htdocs" should be "664".  
[FAILED]  Owner of Document Root "/var/www//htdocs" should be root.  
[FAILED]  Log directory "logs" does not exist.  
[FAILED]  CGI directory "" does not exist.  
[VERIFY]  Server Bin directory "/var/www//bin/" group is properly set.  
[FAILED]  Permissions on Server Bin directory "/var/www//bin/" should be "550".  
[PASSED]  Owner of Server Bin directory "/var/www//bin/" is root.  

Section 1.25 Update the Apachectl Script for Email Notification
[FAILED]  Updated the default apachectl start script's code to send alerts to the appropriate personnel? (Answer: No)  
Apache Benchmark Tool Results Apache Configuration File: /var/www/conf/httpd.conf
Benchark Score: 1.45 out of 10.00
Thursday, April 19th 2007 at 11:06:54 A.M.