STIGViewer Support

The Apache web server must display a default hosted application web page, not a directory listing, when a requested web page cannot be found.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-214292AS24-U2-000620SV-214292r961167_ruleCCI-001312medium
Description
The goal is to completely control the web user's experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an index.html file is a significant factor to accomplish this end. Enumeration techniques, such as URL parameter manipulation, rely upon being able to obtain information about the Apache web server's directory structure by locating directories without default pages. In the scenario, the Apache web server will display to the user a listing of the files in the directory being accessed. By having a default hosted application web page, the anonymous web user will not obtain directory browsing information or an error message that reveals the server type and version.
STIGDate
Apache Server 2.4 UNIX Site Security Technical Implementation Guide2025-02-12

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

TDA-19Error Handling
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (19) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-10Non-repudiation
1.00
AU-12Audit Record Generation
1.00
AU-14(1)System Start-up
1.00
AU-3Content of Audit Records
1.00
AU-3(1)Additional Audit Information
1.00
AU-9Protection of Audit Information
1.00
CM-3(5)Automated Security Response
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00

+9 more (top 10 by confidence shown)

CCI1 mapping

Details

Check Text (C-214292r961167_chk)

View the "DocumentRoot" value by entering the following command: awk '{print $1,$2,$3}' <'INSTALL PATH'>/conf/httpd.conf|grep -i DocumentRoot|grep -v '^#' Note each location following the "DocumentRoot" string. This is the configured path(s) to the document root directory(s). To view a list of the directories and subdirectories and the file "index.html", from each stated "DocumentRoot" location enter the following commands: find . -type d find . -type f -name index.html Review the results for each document root directory and its subdirectories. If a directory does not contain an "index.html" or equivalent default document, this is a finding.

Fix Text (F-15503r881497_fix)

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file: # apachectl -V | egrep -i 'httpd_root|server_config_file' -D HTTPD_ROOT="/etc/httpd" -D SERVER_CONFIG_FILE="conf/httpd.conf" Add a default document to the applicable directories.