Restrict Web Directory
The default configuration for the web ('/var/www/html') Directory allows directory
indexing ('Indexes') and the following of symbolic links ('FollowSymLinks').
Neither of these is recommended.
The '/var/www/html' directory hierarchy should not be viewable via the web, and
symlinks should only be followed if the owner of the symlink also owns the linked file.
Ensure that this policy is adhered to by altering the related section of the configuration:
<Directory "/var/www/html">
# ...
Options SymLinksIfOwnerMatch
# ...
</Directory>
Access to the web server's directory hierarchy could allow access to unauthorized files
by web clients. Following symbolic links could also allow such access.
Fix:
No Remediation Info
oval:org.secpod.oval:def:48408
oval:org.secpod.oval:def:48408
oval:org.secpod.oval:def:48712
SCAP Repo OVAL Definition
2018-11-08