Linux - SoftwareThis forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
I am using Ubuntu 5.10 (Breezy Badger).
I would like to know how to prevent directory listings in Apache2 on Ubuntu.
For example, I am able to view the contents of a folder called "test" that I created inside /var/www. I don't want visitors to be able to view the contents of directories.
Have a look in your httpd.conf file. There will be an Options directive in the Directory section that has the Indexes option set. If there are other options that you want to keep, just remove Indexes. For example, the following displays indexes (I've removed the other lines):
Or you can make the directory not readable by the Apache user; then it will certainly not display a listing. This is probably the simplest option. I do this for all of my webspaces, whether or not I use an index page.
I routinely put an index.html file in every directory. I do this because if I am hosted on someone else's server then I don't want to have to deal with how they may have configured their Apache, and on my own servers it makes it easier for me to tell directly when I do a directory listing - and it is one less thing I have to deal with when I move the site to another server.
My index.html file is always a redirect, taking the visitor to where I want them to start.
You also could put a DirectoryIndex directive into .htaccess
I first started using Apache on Fedora Core 4 and was used to having all the config settings in httpd.conf. Now that I'm using Ubuntu 5.10 (Breezy Badger), I've noticed the Apache settings are handled a bit differently. There's an apache2.conf file, httpd.conf file, and ports.conf file.
In order to prevent listing the contents of /var/www/testdir (using the indexes method), I had to edit the httpd.conf file, as shown below:
Code:
# This is here for backwards compatability reasons and to support
# installing 3rd party modules directly via apxs2, rather than
# through the /etc/apache2/mods-{available,enabled} mechanism.
#
#LoadModule mod_placeholder /usr/lib/apache2/modules/mod_placeholder.so
#
<Directory "/var/www/testdir">
Options -Indexes
</Directory>
That's the entire content of my httpd.conf. Isn't there supposed to be a lot more in this file?
Another option to prevent listing the contents of /var/www/testdir (using the indexes method), was to edit /etc/apache2/sites-available/default. Here are the contents of that file:
Code:
NameVirtualHost *
<VirtualHost *>
ServerAdmin webmaster@localhost
DocumentRoot /var/www/
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
allow from all
# This directive allows us to have apache2's default start page
# in /apache2-default/, but still have / go to the right place
# Commented out for Ubuntu
#RedirectMatch ^/$ /apache2-default/
</Directory>
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
<Directory "/usr/lib/cgi-bin">
AllowOverride None
Options ExecCGI -MultiViews +SymLinksIfOwnerMatch
Order allow,deny
Allow from all
</Directory>
ErrorLog /var/log/apache2/error.log
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn
CustomLog /var/log/apache2/access.log combined
ServerSignature On
Alias /doc/ "/usr/share/doc/"
<Directory "/usr/share/doc/">
Options Indexes MultiViews FollowSymLinks
AllowOverride None
Order deny,allow
Deny from all
Allow from 127.0.0.0/255.0.0.0 ::1/128
</Directory>
</VirtualHost>
I removed Indexes from:
Code:
<Directory /var/www/>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
allow from all
Even though it now does what I want it to, I'm very confused and wondering if I'm editing settings in the right place. Can someone please explain why things are quite different in Ubuntu compared to FC4? Why not just one file to edit, httpd.conf? I guess I'm just trying to understand Ubuntu's way of doing things.
DocumentRoot /var/www/
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
allow from all
# This directive allows us to have apache2's default start page
# in /apache2-default/, but still have / go to the right place
# Commented out for Ubuntu
#RedirectMatch ^/$ /apache2-default/
</Directory>
My default page doesn't have the "Options Indexes" in it and it still allows directory browsing. I only have Options FollowSymLinks, nothing else. I've added -Indexes (restarted Apache2) but it still allows listing the directory. I've added a <Directory> entry for the specific directory also (/var/www/mydirectory) but still listing is allowed! I'm at my wits end, somebody have any ideas???? Thanks.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.