TMA-APACHE-2.5
Ensure the Autoindex Module Is Disabled
MediumLevel 1Automatedapache
Description
The Apache autoindex module automatically generates web page listing the contents of directories on the server, typically used so that an index.html does not have to be generated. Counts loaded modules matching autoindex_module; expects 0. Uses the module list from apachectl -M (apache2ctl/httpd; needs root).
How it is checked
Audit method: Shell command
shell
b=$(command -v apache2ctl || command -v apachectl || command -v httpd) || exit 1; m=$("$b" ${APACHE_CONF:+-f "$APACHE_CONF"} -M 2>/dev/null) || exit 1; printf '%s\n' "$m" | grep -Eic 'autoindex_module' || true- Expected output
0
How it is fixed
Fix method: Guidance or infrastructure patch
Comment out LoadModule autoindex_module or run a2dismod -f autoindex. Then run apachectl configtest and reload Apache.
Properties
- Operating systems
- Any
- Tags
- apachemodules
- Reference
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 2.5 Ensure the Autoindex Module Is Disabled
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target apache