Automatic directory indexing must be disabled.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-26368 | WA00515 | WA00515 A22 | SV-33219r1_rule | 2019-01-07 | 1 |
| Description |
|---|
| To identify the type of web servers and versions software installed it is common for attackers to scan for icons or special content specific to the server type and version. A simple request like http://example.com/icons/apache_pb2.png may tell the attacker that the server is Apache 2.2 as shown below. The many icons are used primary for auto indexing, which is recommended to be disabled. |
| ℹ️ Check |
|---|
| Enter the following command: /usr/local/Apache2.2/bin/httpd –M. This will provide a list of all loaded modules. If autoindex_module is found, this is a finding. |
| ✔️ Fix |
|---|
| Edit the httpd.conf file and remove autoindex_module. |