Lighttpd must not use symbolic links in the Lighttpd web content directory tree.

Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

Lighttpd must not use symbolic links in the Lighttpd web content directory tree.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-240246	VRAU-LI-000215	SV-240246r879587_rule		High

Description
A symbolic link allows a file or a directory to be referenced using a symbolic name raising a potential hazard if symbolic linkage is made to a sensitive area. When web scripts are executed and symbolic links are allowed, the Lighttpd could be allowed to access locations on the server that are outside the scope of the hosted application document root or home directory.

STIG	Date
VMware vRealize Automation 7.x Lighttpd Security Technical Implementation Guide	2023-09-12

Details

Check Text ( C-43479r667913_chk )
At the command prompt, execute the following command: find /opt/vmware/share/htdocs -type l If any files are listed, this is a finding.

Fix Text (F-43438r667914_fix)
At the command prompt, enter the following commands: Note: Replace for the name of any files that were returned. unlink Repeat the commands for each file that was listed.