Each readable web document directory will contain either default, home, index, or equivalent file.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2245	WG170	SV-2245r6_rule	ECSC-1	Low

Description
The goal is to completely control the web users experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an index.html file is a significant factor to accomplish this end. Also, enumeration techniques, such as URL parameter manipulation, rely upon being able to obtain information about the web server’s directory structure by locating directories with default pages. This practice helps ensure that the anonymous web user will not obtain directory browsing information or an error message that reveals the server type and version.

Description

The goal is to completely control the web users experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an index.html file is a significant factor to accomplish this end. Also, enumeration techniques, such as URL parameter manipulation, rely upon being able to obtain information about the web server’s directory structure by locating directories with default pages. This practice helps ensure that the anonymous web user will not obtain directory browsing information or an error message that reveals the server type and version.

STIG	Date
Web Server STIG	2010-10-07

Details

Check Text ( C-29333r1_chk )
The reviewer will query the IAO, the SA, the web administrator, or developers as necessary to determine if the web server is configured to have all web sites point to a default web page. To validate this, the reviewer will ask the SA to demonstrate how this is configured for the particular web server. If the SA, or the web administrator, cannot demonstrate that each of the web sites or virtual directories have default pages, this is a finding.

Check Text ( C-29333r1_chk )

The reviewer will query the IAO, the SA, the web administrator, or developers as necessary to determine if the web server is configured to have all web sites point to a default web page.

To validate this, the reviewer will ask the SA to demonstrate how this is configured for the particular web server.

If the SA, or the web administrator, cannot demonstrate that each of the web sites or virtual directories have default pages, this is a finding.