Automatic directory indexing must be disabled.

From APACHE SERVER 2.2 for Unix Security Technical Implementation Guide

SV-33219r1_rule Automatic directory indexing must be disabled.

Vulnerability discussion

To identify the type of web servers and versions software installed it is common for attackers to scan for icons or special content specific to the server type and version. A simple request like http://example.com/icons/apache_pb2.png may tell the attacker that the server is Apache 2.2 as shown below. The many icons are used primary for auto indexing, which is recommended to be disabled.

Check content

Enter the following command: /usr/local/Apache2.2/bin/httpd –M. This will provide a list of all loaded modules. If autoindex_module is found, this is a finding.

Fix text

Edit the httpd.conf file and remove autoindex_module.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.