PCI Compliance Issue with httpd.conf

Customer Support H-Sphere Reseller Hosting
1

Hello,

Our website passed the PCI Compliance last year. This month, however, it has failed due to this error on port 80 and 443:

The remote Apache server can be used to guess the presence of a given user name on the remote host. Description : When configured with the ‘UserDir’ option, requests to URLs containing a tilde followed by a username will redirect the user to a given subdirectory in the user home. For instance, by default, requesting /~root/ displays the HTML contents from /root/public_html/. If the username requested does not exist, then Apache will reply with a different error code. Therefore, an attacker may exploit this vulnerability to guess the presence of a given user name on the remote host. Solution: In httpd.conf, set the ‘UserDir’ to ‘disabled’. Risk Factor: Medium

How would I go about changing that httpd.conf file? Where is it located?

Thanks,
Shannon

2

Oh - this is what I found on the apache website:

If you are using Apache 1.3 or above, we strongly recommend that you include the following line in your server configuration files:

UserDir disabled root

Is this something I can do? Or does it have to be done by the Jodohost team?

Shannon

3

best snd via ticket :slight_smile:

4

It seems the PCI Compliance scanner is misinterpreting the results.
The module is not even enabled on the server.