Disable web server services on systems that do not serve web content

Description

Web servers packaged by Debian: Apache (apache2.service), nginx (nginx.service) and lighttpd (lighttpd.service). They are often pulled in as dependencies of other software.

The control passes when each unit is masked or not installed at all.

A unit that does not exist counts as compliant, so removing the package is an equally valid fix.

Rationale

A web server that nobody expects is not patched, monitored or hardened, and may publish directories or status pages that reveal information. It is remotely reachable code.

Impact

Masking a unit stops it and prevents it from starting again. Web servers and reverse proxies must exclude this control in their tailoring file, with the reason, for example:

exclude:
  - control: CB-DEB-SVC-008
    reason: Web server role (nginx serves the intranet).

Audit

For each unit, run systemctl is-enabled <unit>. It must print masked, or fail because the unit does not exist: apache2.service, nginx.service, lighttpd.service.

Automated: every check must pass. Scanners report each check by its id.

apache2

Apache HTTP server.

unit: apache2.service
state: masked

nginx

nginx web server.

unit: nginx.service
state: masked

lighttpd

lighttpd web server.

unit: lighttpd.service
state: masked

Remediation

Stop and mask each unit that is installed: systemctl mask --now <unit>. If the package is not needed at all, remove it instead: apt purge apache2 nginx lighttpd.

Rollback

Run systemctl unmask <unit> then systemctl enable --now <unit>.

apache2

Generated from check apache2: the engine writes the fix for every output, it sets the expected value and the check runs again after.

nginx

Generated from check nginx: the engine writes the fix for every output, it sets the expected value and the check runs again after.

lighttpd

Generated from check lighttpd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• apache2(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• nginx(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• systemctl(1), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-SVC-009 Disable the Squid web proxy on systems that are not proxy servers

People and lifecycle