My Nessus network scanner reported the following:
MacOS X creates a hidden file, '.DS_Store' in each directory that has
been viewed with the 'Finder'. This file contains a list of the
contents of the directory, giving an attacker information on the
structure and contents of your website.
Solution: Use a <FilesMatch> directive in httpd.conf to forbid
retrieval of this file:
<FilesMatch '^\.[Dd][Ss]_[Ss]'>
Order allow, deny
Deny from all
</FilesMatch>
and restart Apache.
Easy fix, probably worth doing. Even if your webserver is not running OS X, depending on how you connect and shuttle files up to your webserver it is possible for these files to get copied up to the server.
Top
