STIGQter STIGQter: STIG Summary: APACHE 2.2 Site for UNIX Security Technical Implementation Guide Version: 1 Release: 11 Benchmark Date: 25 Jan 2019:

A web site must not contain a robots.txt file.

DISA Rule

SV-33028r2_rule

Vulnerability Number

V-2260

Group Title

WG310

Rule Version

WG310 A22

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Remove the robots.txt file from the web site. If there is information on the web site that needs protection from search engines and public view, then other methods must be used to safeguard the data.

Check Contents

Locate the Apache httpd.conf file.

If unable to locate the file, perform a search of the system to find the location of the file.

Open the httpd.conf file with an editor and search for the following uncommented directives: DocumentRoot & Alias

Navigate to the location(s) specified in the Include statement(s), and review each file for the following uncommented directives: DocumentRoot & Alias

At the top level of the directories identified after the enabled DocumentRoot & Alias directives, verify that a “robots.txt” file does not exist. If the file does exist, this is a finding.

Vulnerability Number

V-2260

Documentable

False

Rule Version

WG310 A22

Severity Override Guidance

Locate the Apache httpd.conf file.

If unable to locate the file, perform a search of the system to find the location of the file.

Open the httpd.conf file with an editor and search for the following uncommented directives: DocumentRoot & Alias

Navigate to the location(s) specified in the Include statement(s), and review each file for the following uncommented directives: DocumentRoot & Alias

At the top level of the directories identified after the enabled DocumentRoot & Alias directives, verify that a “robots.txt” file does not exist. If the file does exist, this is a finding.

Check Content Reference

M

Responsibility

Web Administrator

Target Key

161

Comments