UCF STIG Viewer Logo

The vCenter VAMI service must disable directory listing.


Finding ID Version Rule ID IA Controls Severity
V-259151 VCLD-80-000062 SV-259151r935357_rule Medium
The goal is to completely control the web user's experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an "index.html" file is a significant factor to accomplish this end. Enumeration techniques, such as Uniform Resource Locator (URL) parameter manipulation, rely on being able to obtain information about the web server's directory structure by locating directories without default pages. In this scenario, the web server will display to the user a listing of the files in the directory being accessed. By having a default hosted application web page, the anonymous web user will not obtain directory browsing information or an error message that reveals the server type and version.
VMware vSphere 8.0 vCenter Appliance Management Interface (VAMI) Security Technical Implementation Guide 2023-10-29


Check Text ( C-62891r935355_chk )
At the command prompt, run the following command:

# /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2>/dev/null|grep "dir-listing.activate"

Expected result:


If the output does not match the expected result, this is a finding.

Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details:

Fix Text (F-62800r935356_fix)
Navigate to and open:


Add or reconfigure the following value:

dir-listing.activate = "disable"

Restart the service with the following command:

# vmon-cli --restart applmgmt