Details
The goal is to completely control the web user’s experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an ‘index.html’ file is a significant factor to accomplish this end.
Enumeration techniques, such as URL parameter manipulation, rely on being able to obtain information about the web server’s directory structure by locating directories without default pages. In this scenario, the web server will display to the user a listing of the files in the directory being accessed. By having a default hosted application web page, the anonymous web user will not obtain directory browsing information or an error message that reveals the server type and version.
Solution
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf.
Add or reconfigure the following value:
dir-listing.activate = ‘disable’
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: System and Information Integrity.This control applies to the following type of system Unix.
References
- 800-53|SI-11a.
- CAT|II
- CCI|CCI-001312
- Rule-ID|SV-239736r679318_rule
- STIG-ID|VCLD-67-000029
- Vuln-ID|V-239736