← Back to VMware vRealize Automation 7.x Lighttpd Security Technical Implementation Guide

V-240246

CAT I (High)

Lighttpd must not use symbolic links in the Lighttpd web content directory tree.

Rule ID

SV-240246r879587_rule

STIG

VMware vRealize Automation 7.x Lighttpd Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-000381

Discussion

A symbolic link allows a file or a directory to be referenced using a symbolic name raising a potential hazard if symbolic linkage is made to a sensitive area. When web scripts are executed and symbolic links are allowed, the Lighttpd could be allowed to access locations on the server that are outside the scope of the hosted application document root or home directory.

Check Content

At the command prompt, execute the following command:

find /opt/vmware/share/htdocs -type l

If any files are listed, this is a finding.

Fix Text

At the command prompt, enter the following commands:

Note: Replace <file_name> for the name of any files that were returned.

unlink <file_name>

Repeat the commands for each file that was listed.