Free DISA STIG and SRG Library | Vaulted

V-3085

The network element must have HTTP service for administrative access disabled.

Finding ID
NET0740
Rule ID
SV-41467r1_rule41467r2_rule
Severity
Cat II
CCE
(None)
Group Title
HTTP server is not disabled
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The additional services that the router is enabled for increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an attacker to gain access to the router. Most recent software versions support remote configuration and monitoring using the World Wide Web's HTTP protocol. In general, HTTP access is equivalent to interactive access to the router. The authentication protocol used for HTTP is equivalent to sending a clear-text password across the network, and, unfortunately, there is no effective provision in HTTP for challenge-based or one-time passwords. This makes HTTP a relatively risky choice for use across the public Internet. Any additional services that are enabled increase the risk for an attack since the router will listen for these services. The HTTPS server may be enabled for administrative access.

Fix Text

Configure the device to disable using HTTP (port 80) for administrative access.

Check Content

Verify that the command "ip http-server" is not definedenabled in the configuration (the HTTPS server may be enabled for administrative access). As of 12.4, the http server is still disabled by default. However, since many defaults are not shown by IOS, you may not see the command "no ip http-server" in the configuration depending on the release. If the HTTP server is enabled, this is a finding.

Responsibility

Information Assurance Officer