Information
The Apache 'Options' directive allows for specific configuration of options, including:
- Execution of CGI
- Following symbolic links
- Server side includes
- Content negotiation
Rationale:
The 'Options' directive at the web root or document root level also needs to be restricted to the minimal options required. A setting of 'None' is highly recommended, however it is recognized that this level content negotiation may be needed if multiple languages are supported. No other options should be enabled.
Solution
Perform the following to implement the recommended state:
1. Search the Apache configuration files ('httpd.conf' and any included configuration files) to find the document root '<Directory>' element.
2. Add or modify any existing 'Options' directive to have a value of 'None' or 'Multiviews', if multiviews are needed.
<Directory '/usr/local/apache2/htdocs'>
...
Options None
...
</Directory>