VCLD-70-000020 - VAMI must disable directory browsing.

Information

The goal is to completely control the web user's experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an 'index.html' file is a significant factor to accomplish this end.

Enumeration techniques, such as Uniform Resource Locator (URL) parameter manipulation, rely on being able to obtain information about the web server's directory structure by locating directories without default pages. In this scenario, the web server will display to the user a listing of the files in the directory being accessed. By having a default hosted application web page, the anonymous web user will not obtain directory browsing information or an error message that reveals the server type and version.

Solution

Navigate to and open:

/opt/vmware/etc/lighttpd/lighttpd.conf

Add or reconfigure the following value:

dir-listing.activate = 'disable'

Restart the service with the following command:

# vmon-cli --restart applmgmt

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_7-0_Y23M07_STIG.zip

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-11a., CAT|II, CCI|CCI-001312, Rule-ID|SV-256664r888514_rule, STIG-ID|VCLD-70-000020, Vuln-ID|V-256664

Plugin: Unix

Control ID: fc4fe1baf5cdb913d891711051372e56568519f3748c88cc177554fefb0d0183