VCLD-67-000029 - VAMI must disable directory browsing.

Information

The goal is to completely control the web user's experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an 'index.html' file is a significant factor to accomplish this end.

Enumeration techniques, such as URL parameter manipulation, rely on being able to obtain information about the web server's directory structure by locating directories without default pages. In this scenario, the web server will display to the user a listing of the files in the directory being accessed. By having a default hosted application web page, the anonymous web user will not obtain directory browsing information or an error message that reveals the server type and version.

Solution

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf.

Add or reconfigure the following value:

dir-listing.activate = 'disable'

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_Y23M07_STIG.zip

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-11a., CAT|II, CCI|CCI-001312, Rule-ID|SV-239736r879655_rule, STIG-ID|VCLD-67-000029, Vuln-ID|V-239736

Plugin: Unix

Control ID: 8403db8b556fce59c159101c9092ecf4ed1ad8d8342c59a4bbc4443fb6acd342