Files and Directories are readable under the /siteminderagent/ URL

Products

• SITEMINDER

Issue/Introduction

The list of files and directories under the /siteminderagent/ URL is readable to the end user.  

Environment

PRODUCT: Siteminder

COMPONENT: Web Agent

WEB SERVER: Apache

WEB SERVER OS: Any

Cause

Within the 'httpd.conf' file the path listed within the Directory directive is likely populated with the Options directive and allowing Indexes.

• <Directory> and </Directory> are used to enclose a group of directives that will apply only to the named directory, sub-directories of that directory, and the files within the respective directories. Any directive that is allowed in a directory context may be used.
• Indexes
  If a URL which maps to a directory is requested and there is no DirectoryIndex (e.g., index.html) in that directory, then mod_autoindex will return a formatted listing of the directory.

Resolution

Exclude 'Indexes' from the Options directive within the Directory.

EXAMPLE:

<Directory "/opt/CA/webagent/samples/">
Options -Indexes
AllowOverride None
Require all granted
</Directory>

Additional Information

Apache HTTP Server: Directory Directive

Apache HTTP Server: Option Directive