LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices

Reply
 
Search this Thread
Old 03-13-2006, 04:15 PM   #1
nick1
Member
 
Registered: Oct 2004
Posts: 47

Rep: Reputation: 15
Apache2: Prevent Directory Listing


Greetings,

I am using Ubuntu 5.10 (Breezy Badger).
I would like to know how to prevent directory listings in Apache2 on Ubuntu.
For example, I am able to view the contents of a folder called "test" that I created inside /var/www. I don't want visitors to be able to view the contents of directories.

Thank you for your time,

Nick
 
Old 03-13-2006, 04:26 PM   #2
gilead
Senior Member
 
Registered: Dec 2005
Location: Brisbane, Australia
Distribution: Slackware64 14.0
Posts: 4,123

Rep: Reputation: 162Reputation: 162
Have a look in your httpd.conf file. There will be an Options directive in the Directory section that has the Indexes option set. If there are other options that you want to keep, just remove Indexes. For example, the following displays indexes (I've removed the other lines):
Code:
<Directory "/var/www/html">
  Options Indexes FollowSymLinks
  IndexOptions FancyIndexing FoldersFirst IgnoreCase VersionSort NameWidth=*
</Directory>
The following does not:
Code:
<Directory "/var/www/html">
  Options FollowSymLinks
</Directory>
IIRC, If Indexes is turned on at a higher level, you can also turn it off for a single Directory entry with Options -Indexes

Last edited by gilead; 03-13-2006 at 04:30 PM.
 
Old 03-13-2006, 04:27 PM   #3
brian_lad
Member
 
Registered: Feb 2006
Location: Overland Park, KS
Distribution: RedHat EL, Fedora, Ubuntu
Posts: 32

Rep: Reputation: 15
You might try placing the following in your httpd.conf file

<Directory /var/www/test>
Options -Indexes
</Directory>

Also I believe if you create an index.html file in the test directory this would also stop the viewing of the folder contents.

Brian
 
Old 03-13-2006, 04:38 PM   #4
tomdkat
Member
 
Registered: May 2003
Location: S.F. Bay Area
Distribution: Ubuntu 9.04 AMD64
Posts: 595

Rep: Reputation: 30
Quote:
Originally Posted by brian_lad
Also I believe if you create an index.html file in the test directory this would also stop the viewing of the folder contents.
Yep, that also works. That might even be simpler.

Have an index.html file with nothing in it except the most basic HTML:

Code:
<html><body></body></html>
Or you could have some fun with it:

Code:
<html><body><H1>GOTCHA!!!!!</h1><br><br><H2>You know you shouldn't try to view the raw images like this... Tisk, tisk tisk...</h2></body></html>
You could also include a redirect in the "head" section of the HTML file to redirect to a gallery page or something after a certain amount of time.

Peace...
 
Old 03-13-2006, 06:13 PM   #5
spooon
Senior Member
 
Registered: Aug 2005
Posts: 1,755

Rep: Reputation: 48
Or you can make the directory not readable by the Apache user; then it will certainly not display a listing. This is probably the simplest option. I do this for all of my webspaces, whether or not I use an index page.

Last edited by spooon; 03-13-2006 at 11:05 PM.
 
Old 03-13-2006, 07:49 PM   #6
jiml8
Senior Member
 
Registered: Sep 2003
Posts: 3,171

Rep: Reputation: 114Reputation: 114
I routinely put an index.html file in every directory. I do this because if I am hosted on someone else's server then I don't want to have to deal with how they may have configured their Apache, and on my own servers it makes it easier for me to tell directly when I do a directory listing - and it is one less thing I have to deal with when I move the site to another server.

My index.html file is always a redirect, taking the visitor to where I want them to start.

You also could put a DirectoryIndex directive into .htaccess
 
Old 03-13-2006, 10:32 PM   #7
nick1
Member
 
Registered: Oct 2004
Posts: 47

Original Poster
Rep: Reputation: 15
Thanks to everyone who replied.

I first started using Apache on Fedora Core 4 and was used to having all the config settings in httpd.conf. Now that I'm using Ubuntu 5.10 (Breezy Badger), I've noticed the Apache settings are handled a bit differently. There's an apache2.conf file, httpd.conf file, and ports.conf file.

In order to prevent listing the contents of /var/www/testdir (using the indexes method), I had to edit the httpd.conf file, as shown below:

Code:
# This is here for backwards compatability reasons and to support
#  installing 3rd party modules directly via apxs2, rather than
#  through the /etc/apache2/mods-{available,enabled} mechanism.
#
#LoadModule mod_placeholder /usr/lib/apache2/modules/mod_placeholder.so
#
<Directory "/var/www/testdir">
  Options -Indexes
</Directory>
That's the entire content of my httpd.conf. Isn't there supposed to be a lot more in this file?

Another option to prevent listing the contents of /var/www/testdir (using the indexes method), was to edit /etc/apache2/sites-available/default. Here are the contents of that file:

Code:
NameVirtualHost *
<VirtualHost *>
	ServerAdmin webmaster@localhost
	
	DocumentRoot /var/www/
	<Directory />
		Options FollowSymLinks
		AllowOverride None
	</Directory>
	<Directory /var/www/>
		Options Indexes FollowSymLinks MultiViews
		AllowOverride None
		Order allow,deny
		allow from all
		# This directive allows us to have apache2's default start page
                # in /apache2-default/, but still have / go to the right place
                # Commented out for Ubuntu
                #RedirectMatch ^/$ /apache2-default/
	</Directory>

	ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
	<Directory "/usr/lib/cgi-bin">
		AllowOverride None
		Options ExecCGI -MultiViews +SymLinksIfOwnerMatch
		Order allow,deny
		Allow from all
	</Directory>

	ErrorLog /var/log/apache2/error.log

	# Possible values include: debug, info, notice, warn, error, crit,
	# alert, emerg.
	LogLevel warn

	CustomLog /var/log/apache2/access.log combined
	ServerSignature On

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>

</VirtualHost>
I removed Indexes from:

Code:
<Directory /var/www/>
	Options Indexes FollowSymLinks MultiViews
	AllowOverride None
	Order allow,deny
	allow from all
Even though it now does what I want it to, I'm very confused and wondering if I'm editing settings in the right place. Can someone please explain why things are quite different in Ubuntu compared to FC4? Why not just one file to edit, httpd.conf? I guess I'm just trying to understand Ubuntu's way of doing things.

Thanks a lot,

*Nick*
 
Old 03-14-2006, 02:44 PM   #8
jiml8
Senior Member
 
Registered: Sep 2003
Posts: 3,171

Rep: Reputation: 114Reputation: 114
You are using Apache2 in Ubuntu and, I presume, you were using Apache 1.3 in FC4.

Apache2 makes a lot of changes. I suggest you visit apache.org to learn about it.
 
Old 03-14-2006, 02:49 PM   #9
tomdkat
Member
 
Registered: May 2003
Location: S.F. Bay Area
Distribution: Ubuntu 9.04 AMD64
Posts: 595

Rep: Reputation: 30
Quote:
Originally Posted by jiml8
Apache2 makes a lot of changes. I suggest you visit apache.org to learn about it.
True, but not in this case. The Indexes option is the same. In fact, I use it on some sites and not on others hosted on an Apache 2 server I run.

Peace...
 
Old 03-14-2006, 03:55 PM   #10
spooon
Senior Member
 
Registered: Aug 2005
Posts: 1,755

Rep: Reputation: 48
Quote:
Originally Posted by jiml8
I presume, you were using Apache 1.3 in FC4.
No, FC2/3/4 all come with Apache 2.
 
Old 02-21-2014, 04:40 PM   #11
arpals
LQ Newbie
 
Registered: Feb 2014
Posts: 1

Rep: Reputation: Disabled
Apache2: Prevent Directory Listing

Quote:
DocumentRoot /var/www/
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
allow from all
# This directive allows us to have apache2's default start page
# in /apache2-default/, but still have / go to the right place
# Commented out for Ubuntu
#RedirectMatch ^/$ /apache2-default/
</Directory>
My default page doesn't have the "Options Indexes" in it and it still allows directory browsing. I only have Options FollowSymLinks, nothing else. I've added -Indexes (restarted Apache2) but it still allows listing the directory. I've added a <Directory> entry for the specific directory also (/var/www/mydirectory) but still listing is allowed! I'm at my wits end, somebody have any ideas???? Thanks.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Apache Directory Listing Of NFS Mount, cannot view directory list via apache luqmana Linux - Networking 2 12-19-2005 06:03 AM
Apache2 listing colabus Linux - Software 1 11-09-2005 06:51 PM
how to prevent listing hidden files from been shown? greythorne Suse/Novell 5 03-16-2005 09:01 AM
Apache2 Directory Listing issue DrJonesAC2 Linux - Software 5 09-12-2004 04:25 AM
how to prevent directory listing in apache ? chuck77 Linux - General 7 12-21-2001 03:27 AM


All times are GMT -5. The time now is 03:32 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration