5.1 Ensure Options for the OS Root Directory Are Restricted

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The Apache Options directive allows for specific configuration of options, including execution of CGI, following symbolic links, server side includes, and content negotiation.

Rationale:

The Options directive for the root OS level is used to create a default minimal options policy that allows only the minimal options at the root directory level. Then for specific web sites or portions of the web site, options may be enabled as needed and appropriate. No options should be enabled and the value for the Options directive should be None.

Solution

Perform the following to implement the recommended state:

Search the Apache configuration files (httpd.conf and any included configuration files) to find a root <Directory> element.

Add a single Options directive if there is none.

Set the value for Options to None.

<Directory />
. . .
Options None
. . .
</Directory>

Default Value:

The default value for the root directory's Option directive is Indexes FollowSymLinks.

See Also

https://workbench.cisecurity.org/files/3021