diff --git a/docs/source/advanced/security/apache_hardening.rst b/docs/source/advanced/security/apache_hardening.rst
new file mode 100644
index 000000000..22787ffbc
--- /dev/null
+++ b/docs/source/advanced/security/apache_hardening.rst
@@ -0,0 +1,172 @@
+Apache Hardening
+================
+
+xCAT uses Apache HTTP Server to serve install media, postscripts, and boot
+files to nodes during provisioning. The default configuration prioritizes
+ease of deployment, but administrators should apply the hardening measures
+below to reduce the attack surface.
+
+Directory Indexing Disabled by Default
+--------------------------------------
+
+Starting with xCAT 2.18, directory indexing (``Options Indexes``) is disabled
+by default for the ``/install`` and ``/tftpboot`` directories. This prevents
+unauthenticated users from browsing directory listings and discovering file
+paths. All provisioning workflows continue to work because nodes fetch files
+by their known paths.
+
+If you are upgrading from an earlier version of xCAT, update your Apache
+configuration manually. Remove ``Indexes`` from the ``/install`` and
+``/tftpboot`` blocks, but add explicit exceptions for the directories that
+provisioning scripts crawl recursively.
+
+**Apache 2.4** (RHEL 7+, SLES 12+, Ubuntu 16.04+)::
+
+ # /etc/httpd/conf.d/xcat.conf
+
+ Options FollowSymLinks Includes MultiViews
+ AllowOverride None
+ Require all granted
+
+
+ Options FollowSymLinks Includes MultiViews
+ AllowOverride None
+ Require all granted
+
+
+ Options Indexes FollowSymLinks
+ AllowOverride None
+ Require all granted
+
+
+ Options Indexes FollowSymLinks
+ AllowOverride None
+ Require all granted
+
+
+**Apache 2.2** (RHEL 6, SLES 11)::
+
+ # /etc/httpd/conf.d/xcat.conf
+
+ Options FollowSymLinks Includes MultiViews
+ AllowOverride None
+ Order allow,deny
+ Allow from all
+
+
+ Options FollowSymLinks Includes MultiViews
+ AllowOverride None
+ Order allow,deny
+ Allow from all
+
+
+ Options Indexes FollowSymLinks
+ AllowOverride None
+ Order allow,deny
+ Allow from all
+
+
+ Options Indexes FollowSymLinks
+ AllowOverride None
+ Order allow,deny
+ Allow from all
+
+
+.. warning::
+
+ Do not remove ``Indexes`` from ``/install/postscripts`` or
+ ``/install/post``. xCAT provisioning scripts use recursive ``wget`` to
+ download all files from these directories and depend on Apache directory
+ listings to discover file paths.
+
+Sensitive Directories
+---------------------
+
+The following directories under ``/install`` may contain sensitive data and
+should be protected with restrictive filesystem permissions:
+
+``/install/custom/``
+ Custom postscripts, templates, and package lists. May contain hardcoded
+ credentials or internal configuration details.
+
+``/install/syncfiles/``
+ Files synchronized to nodes. May include password files, SSL certificates,
+ or application secrets.
+
+``/install/autoinst/``
+ Generated kickstart and preseed files. Contains root password hashes and
+ full network configuration for each node. Nodes fetch these over HTTP
+ during installation, so filesystem permissions cannot be restricted without
+ breaking provisioning. Use IP-based access control (see below) to limit
+ access to the management network instead.
+
+Set restrictive permissions where possible::
+
+ chmod 750 /install/custom
+ chmod 750 /install/syncfiles
+
+.. note::
+
+ Do not restrict filesystem permissions on ``/install/postscripts``,
+ ``/install/autoinst``, or the OS media directories (e.g.,
+ ``/install/rhels9/``), as nodes require HTTP access to these during
+ provisioning. Protect these paths with network-level controls instead.
+
+Database Backups
+----------------
+
+Never store xCAT database backups under ``/install``. The database contains
+BMC credentials, password table entries, and full cluster topology. Store
+backups in a directory not served by Apache, for example::
+
+ dumpxCATdb -p /root/xcat-backups
+
+Network Binding
+---------------
+
+By default, Apache listens on all interfaces. In environments where the
+management network is separate from other networks, bind Apache to the
+management interface only::
+
+ # /etc/httpd/conf/httpd.conf
+ Listen 10.0.0.1:80
+
+Replace ``10.0.0.1`` with the management node's IP on the provisioning
+network.
+
+IP-Based Access Control
+-----------------------
+
+For additional protection, restrict access to the provisioning subnet::
+
+ # Apache 2.4+
+
+ Options FollowSymLinks Includes MultiViews
+ AllowOverride None
+ Require ip 10.0.0.0/16
+
+
+ Options Indexes FollowSymLinks
+ AllowOverride None
+ Require ip 10.0.0.0/16
+
+
+ Options Indexes FollowSymLinks
+ AllowOverride None
+ Require ip 10.0.0.0/16
+
+
+Replace ``10.0.0.0/16`` with your management network CIDR in all blocks.
+This ensures only nodes on the provisioning network can access install media.
+
+.. note::
+
+ If ``linuximage.otherpkgdir`` points to a custom path under ``/install``
+ outside of ``/install/post`` (e.g., ``/install/custom/mypkgs``), add an
+ additional ```` block for that path with ``Options Indexes``
+ to allow recursive package downloads.
+
+.. warning::
+
+ If service nodes or hierarchical xCAT setups are in use, ensure all service
+ node IPs are included in the allowed range.
diff --git a/docs/source/advanced/security/index.rst b/docs/source/advanced/security/index.rst
index 790979759..f119fbcdd 100644
--- a/docs/source/advanced/security/index.rst
+++ b/docs/source/advanced/security/index.rst
@@ -8,3 +8,4 @@ The security of a system covers a wide range of elements, from the security of s
ssl_config.rst
security.rst
+ apache_hardening.rst
diff --git a/xCAT/xcat.conf b/xCAT/xcat.conf
index 89fbd115b..6138086c4 100644
--- a/xCAT/xcat.conf
+++ b/xCAT/xcat.conf
@@ -8,13 +8,25 @@ AliasMatch ^/install/(.*)$ "/install/$1"
AliasMatch ^/tftpboot/(.*)$ "/tftpboot/$1"
- Options Indexes +FollowSymLinks +Includes MultiViews
+ Options FollowSymLinks Includes MultiViews
AllowOverride None
Order allow,deny
Allow from all
- Options Indexes +FollowSymLinks +Includes MultiViews
+ Options FollowSymLinks Includes MultiViews
+ AllowOverride None
+ Order allow,deny
+ Allow from all
+
+
+ Options Indexes FollowSymLinks
+ AllowOverride None
+ Order allow,deny
+ Allow from all
+
+
+ Options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
diff --git a/xCAT/xcat.conf.apach24 b/xCAT/xcat.conf.apach24
index 89e28e345..d1720149f 100644
--- a/xCAT/xcat.conf.apach24
+++ b/xCAT/xcat.conf.apach24
@@ -8,12 +8,22 @@ AliasMatch ^/install/(.*)$ "/install/$1"
AliasMatch ^/tftpboot/(.*)$ "/tftpboot/$1"
- Options Indexes FollowSymLinks Includes MultiViews
+ Options FollowSymLinks Includes MultiViews
AllowOverride None
Require all granted
- Options Indexes FollowSymLinks Includes MultiViews
+ Options FollowSymLinks Includes MultiViews
+ AllowOverride None
+ Require all granted
+
+
+ Options Indexes FollowSymLinks
+ AllowOverride None
+ Require all granted
+
+
+ Options Indexes FollowSymLinks
AllowOverride None
Require all granted
diff --git a/xCATsn/xcat.conf b/xCATsn/xcat.conf
index 89fbd115b..6138086c4 100644
--- a/xCATsn/xcat.conf
+++ b/xCATsn/xcat.conf
@@ -8,13 +8,25 @@ AliasMatch ^/install/(.*)$ "/install/$1"
AliasMatch ^/tftpboot/(.*)$ "/tftpboot/$1"
- Options Indexes +FollowSymLinks +Includes MultiViews
+ Options FollowSymLinks Includes MultiViews
AllowOverride None
Order allow,deny
Allow from all
- Options Indexes +FollowSymLinks +Includes MultiViews
+ Options FollowSymLinks Includes MultiViews
+ AllowOverride None
+ Order allow,deny
+ Allow from all
+
+
+ Options Indexes FollowSymLinks
+ AllowOverride None
+ Order allow,deny
+ Allow from all
+
+
+ Options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
diff --git a/xCATsn/xcat.conf.apach24 b/xCATsn/xcat.conf.apach24
index d4e83370c..0abfff396 100644
--- a/xCATsn/xcat.conf.apach24
+++ b/xCATsn/xcat.conf.apach24
@@ -8,12 +8,22 @@ AliasMatch ^/install/(.*)$ "/install/$1"
AliasMatch ^/tftpboot/(.*)$ "/tftpboot/$1"
- Options Indexes FollowSymLinks Includes MultiViews
+ Options FollowSymLinks Includes MultiViews
AllowOverride None
Require all granted
- Options Indexes FollowSymLinks Includes MultiViews
+ Options FollowSymLinks Includes MultiViews
+ AllowOverride None
+ Require all granted
+
+
+ Options Indexes FollowSymLinks
+ AllowOverride None
+ Require all granted
+
+
+ Options Indexes FollowSymLinks
AllowOverride None
Require all granted