documentation_complete: true

title: 'Restrict Web Directory'

description: |-
    The default configuration for the web (<tt>/var/www/html</tt>) Directory allows directory
    indexing (<tt>Indexes</tt>) and the following of symbolic links (<tt>FollowSymLinks</tt>).
    Neither of these is recommended.
    <br /><br />
    The <tt>/var/www/html</tt> directory hierarchy should not be viewable via the web, and
    symlinks should only be followed if the owner of the symlink also owns the linked file.
    <br /><br />
    Ensure that this policy is adhered to by altering the related section of the configuration:
    <pre>&lt;Directory "/var/www/html"&gt;
    #  ...
       Options SymLinksIfOwnerMatch
    #  ...
    &lt;/Directory&gt;</pre>

rationale: |-
    Access to the web server's directory hierarchy could allow access to unauthorized files
    by web clients. Following symbolic links could also allow such access.

severity: unknown

identifiers:
    cce: 27574-3
