V-240268

Discussion

An attacker has at least two reasons to stop a web server. The first is to cause a DoS, and the second is to put in place changes the attacker made to the web server configuration. To prohibit an attacker from stopping the Lighttpd, the process ID (pid) must be owned by privileged users.

Check Content

At the command prompt, execute the following command:

ps -f -U root | awk '$0 ~ /vami-lighttpd/ && $0 !~ /awk/ {print}'

If the "vami-lighttpd" process is not owned by "root", this is a finding.