{"description": "Copies of backup files will not execute on the server, but they can be\nread by the anonymous user if special precautions are not taken.", "rationale": "Such backup copies contain the same sensitive information as the actual\nscripts being executed and, as such, are useful to malicious users.\nTechniques and systems exist today that search web servers for such files\nand are able to exploit the information contained in them.\n\nBackup copies of files are automatically created by some text editors such\nsuch as emacs and VIM. Editors may write a backup file with an extension\n~ added to the name of the original file. The edit plus editor will\ncreate a .bak file. Of course, this would imply the presence and use of\ndevelopment tools on the web server, which is a finding under WG130. Having\nbackup scripts on the web server provides one more opportunity for\nmalicious persons to view these scripts and use the information found in\nthem.", "severity": "medium", "references": {}, "control_references": {}, "components": [], "identifiers": {}, "ocil_clause": "If fileos with these extensions have no relationship with web activity,\nsuch as backup batch file for operating system utility, and they are\nnot accessible by the web application, this is not a finding.\n\nIf files with these extensions are found in either the document\ndirectory or the home directory of the web server, this is\na finding.\n\nIf files with these extensions are stored in a repository (not in the\ndocument root) as backups for the web server", "ocil": "Ensure that CGI backup scripts are not left on the production web server.\nThis check is limited to CGI/interactive content and not static HTML.\n\nSearch for backup copies of CGI scripts on the web server or ask the Web\nAdministrator if they keep backup copies of CGI scripts on the web server.\n\nCommon backup file extensions are: *.bak, *.old, *.temp, *.tmp, *.backup,\n*.??0. This would also apply to .jsp files.\n\nOn Red Hat Enterprise Linux, run the following commands to find backup\nscripts:\n<pre><tt>find / name \"*.bak\" -print</tt>\n<tt>find / name \"*.*\" -print</tt>\n<tt>find / name \"*.old\" -print</tt></pre>", "oval_external_content": null, "fixtext": "", "checktext": "", "vuldiscussion": "", "srg_requirement": "", "warnings": [], "conflicts": [], "requires": [], "policy_specific_content": {}, "platform": null, "platforms": [], "sce_metadata": {}, "inherited_platforms": [], "cpe_platform_names": [], "inherited_cpe_platform_names": [], "bash_conditional": null, "fixes": {}, "title": "Backup interactive scripts on the production web server are prohibited", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/services/http/securing_httpd/httpd_remove_backups/rule.yml", "template": null}