fix: disable Apache directory indexing on /install and /tftpboot

[viniciusferrao]

Summary

Disable Apache directory indexing (autoindex) on /install and /tftpboot to prevent unauthenticated information disclosure. Provisioning-critical directories that require recursive wget access retain explicit Indexes exceptions.

Problem: The default xCAT Apache config ships with Options Indexes on /install and /tftpboot, allowing anyone with network access to browse the full directory tree — including postscripts, CA certificates, SSH authorized_keys, and (in production) kickstart files with password hashes.

Fix:

• Remove Indexes from parent /install and /tftpboot directory blocks
• Add targeted Indexes exceptions for /install/postscripts and /install/post (required by xcatdsklspost and otherpkgs recursive wget)
• Use absolute Options directives to prevent inheriting unsafe parent settings
• All four shipped config variants updated (MN/SN × Apache 2.2/2.4)
• New Apache hardening documentation with upgrade instructions for both Apache versions

What remains indexed (required for provisioning)

Path	Reason
/install/postscripts/	xcatdsklspost, post.xcat, cumulusztp use recursive wget
/install/post/	otherpkgs uses recursive wget for package directories
/opt/xcat/share/doc/	xcat-doc browsing (harmless)

What is now blocked (403 on directory listing)

Path	Previously exposed
/install/	Full tree listing
/install/custom/	Custom scripts, potential credentials
/install/autoinst/	Kickstart files with password hashes
/tftpboot/	PXE configs, boot topology

Direct file access by known path continues to work for all paths.

Test plan

• apachectl configtest — Syntax OK
• /install/ returns 403 (directory listing blocked)
• /tftpboot/ returns 403 (directory listing blocked)
• /install/postscripts/ returns 200 with full listing (recursive wget works)
• Direct file access (syslog, ca-cert.pem, getcredentials.awk) returns 200
• /xcat-doc/ returns 200 (preserved)
• rpower and xCAT daemon unaffected
• git diff --check clean
• Adversarial review converged (5 passes)

Addresses xcat2#7450

[viniciusferrao]

Provisioning Validation (xCAT 2.18.0, Ubuntu 24.04 MN)

Tested on a lab xCAT 2.18.0 management node with Ubuntu 24.04 compute nodes (KVM VMs).

Apache behavior with patched config

/install/             → 403 (directory listing blocked)
/install/postscripts/ → 200 (listing available for recursive wget)

Recursive wget simulation (what xcatdsklspost does)

# wget -l inf -nH -N -r --waitretry=1 -e robots=off -T 10 -nH \
#   --cut-dirs=2 --reject "index.html*" --no-parent \
#   http://10.10.0.254/install/postscripts/ -P /tmp/xcatpost_test

Downloaded: 241 files, 1.8M in 0.002s (865 MB/s)
Files in /tmp/xcatpost_test: 151

All postscripts downloaded successfully — provisioning path unbroken.

Conclusion

The patched Apache config correctly blocks directory browsing on /install/ root while preserving the recursive wget flow that xcatdsklspost, post.xcat, and otherpkgs depend on.