Description
Web servers packaged by Debian: Apache (apache2.service), nginx (nginx.service) and
lighttpd (lighttpd.service). They are often pulled in as dependencies of other software.
The control passes when each unit is masked or not installed at all.
A unit that does not exist counts as compliant, so removing the package is an equally valid fix.
Rationale
A web server that nobody expects is not patched, monitored or hardened, and may publish directories or status pages that reveal information. It is remotely reachable code.
Impact
Masking a unit stops it and prevents it from starting again. Web servers and reverse proxies must exclude this control in their tailoring file, with the reason, for example:
exclude:
- control: CB-DEB-SVC-008
reason: Web server role (nginx serves the intranet).
Audit
For each unit, run systemctl is-enabled <unit>. It must print masked, or fail because the
unit does not exist: apache2.service, nginx.service, lighttpd.service.
Automated: every check must pass. Scanners report each check by its id.
apache2
Apache HTTP server.
unit: apache2.service
state: masked
nginx
nginx web server.
unit: nginx.service
state: masked
lighttpd
lighttpd web server.
unit: lighttpd.service
state: masked
Remediation
Stop and mask each unit that is installed: systemctl mask --now <unit>. If the package is not
needed at all, remove it instead: apt purge apache2 nginx lighttpd.
| Restart | none |
| Disruption | low |
Rollback
Run systemctl unmask <unit> then systemctl enable --now <unit>.
apache2
Generated from check apache2: the engine writes the fix for every output, it sets the expected value and the check runs again after.
nginx
Generated from check nginx: the engine writes the fix for every output, it sets the expected value and the check runs again after.
lighttpd
Generated from check lighttpd: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- apache2(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
- nginx(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
- systemctl(1), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
- ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62) ANSSI, guide, accessed 2026-10-18
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0 | R62 | partial | R62 asks to disable every unneeded service; this control covers web servers. |
| NIST SP 800-53 Rev. 55.1.1 | CM-7 | partial |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| MITRE ATT&CK | T1190 |
Related controls
- related
CB-DEB-SVC-009Disable the Squid web proxy on systems that are not proxy servers
People and lifecycle
| Authors |
|
| Verified | 2026-10-18 by Sn0wAlice on 12, Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64. Fresh image passes; with apache2 and nginx installed the checks fail, fix masks, audit passes after reboot; packages still purge cleanly. |
| Verified | 2026-10-18 by Sn0wAlice on 13, Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64. Fresh image passes; with apache2 and nginx installed the checks fail, fix masks, audit passes after reboot; packages still purge cleanly. |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-18, 2026-10-18 |
| Translations | fr |
