Prevent directory listing (browsing)?

Epic555 · 02-23-2018, 04:24 AM

Hi, how to prevent directory listing (directory browsing) of "https://myzabbix.com/icons/" web-page?
I found 2 methods how to do it on Apache on CentOS, but it doesn't work:
1) In httpd.conf in section <Directory "/var/www/html"> i removed a word "Indexes" or tried to write "-Indexes" in "Options FollowSymLinks", also i put "AllowOverride All" and restarted Apache.
2) I created .htaccess file in /var/www/html/ and put "Options -Indexes" in it.
But it didnt help.
What is wrong?

bathory · 02-23-2018, 05:18 AM

Quote:

Originally Posted by Epic555

Hi, how to prevent directory listing (directory browsing) of "https://myzabbix.com/icons/" web-page?
I found 2 methods how to do it on Apache on CentOS, but it doesn't work:
1) In httpd.conf in section <Directory "/var/www/html"> i removed a word "Indexes" or tried to write "-Indexes" in "Options FollowSymLinks", also i put "AllowOverride All" and restarted Apache.
2) I created .htaccess file in /var/www/html/ and put "Options -Indexes" in it.
But it didnt help.
What is wrong?

FYI /icons is an Alias to /var/www/icons, so you need to toggle Indexes in that directory stanza in apache config file

Regards

keefaz · 02-23-2018, 08:57 AM

You can put a blank index.html file in the directory to prevent listing

scasey · 02-23-2018, 01:34 PM

The syntax is

Code:

<Directory "/var/www/html">
   Options -Indexes
</Directory>

in httpd.conf

to allow the .htaccess to work, add

Code:

 AllowOverride Options

to the directory container.

The above will suppress directory listings in all directories under /var/www/html

To suppress a specific directory only, create a <Directory ...> container for that directory with the Options directive inside it.

Pretty sure the syntax is the same in an .htaccess file...the Options directive inside a Directory container.

Epic555 · 02-25-2018, 10:24 PM

Quote:

Originally Posted by bathory

FYI /icons is an Alias to /var/www/icons, so you need to toggle Indexes in that directory stanza in apache config file

I did this, but it didn't help.

Quote:

Originally Posted by scasey

The syntax is

Code:

<Directory "/var/www/html">
   Options -Indexes
</Directory>

in httpd.conf
to allow the .htaccess to work, add

Code:

 AllowOverride Options

to the directory container.

It didn't help too.

I created a file zabbix_icons_dir.conf in /etc/httpd/conf.d. with code
<Directory "/usr/share/httpd/icons">
Require all denied
</Directory>
It helped.

scasey · 02-25-2018, 10:37 PM

Quote:

Originally Posted by Epic555

I created a file zabbix_icons_dir.conf in /etc/httpd/conf.d. with code
<Directory "/usr/share/httpd/icons">
Require all denied
</Directory>
It helped.

Well yes, that would, but that's preventing anyone from using any of the files in that directory, not just suppressing the directory listing. If that's ok (if you don't need to use any of those files on any web page), then you're done. Otherwise, add

Code:

Options -Indexes

to that container:

Code:

<Directory "/usr/share/httpd/icons">
   Options -Indexes
   Require all granted
</Directory>

to allow access to the files but still suppress the directory listings.

As I said earlier:

Quote:

Originally Posted by scasey

To suppress a specific directory only, create a <Directory ...> container for that directory with the Options directive inside it.

Epic555 · 02-25-2018, 11:03 PM

Quote:

Originally Posted by scasey

add

Code:

Options -Indexes

to that container:

Code:

<Directory "/usr/share/httpd/icons">
   Options -Indexes
   Require all granted
</Directory>

Do i need to add this to the httpd.conf or .htaccess?
I added it to the httpd.conf, but it didn't help.

scasey · 02-25-2018, 11:26 PM

Quote:

Originally Posted by Epic555

Do i need to add this to the httpd.conf or .htaccess?
I added it to the httpd.conf, but it didn't help.

Quote:

Originally Posted by Epic555

I created a file zabbix_icons_dir.conf in /etc/httpd/conf.d. with code
<Directory "/usr/share/httpd/icons">
Require all denied
</Directory>
It helped.

Add it to the Directory container you created in zabbix_icons_dir.conf in /etc/httpd/conf.d.

PS You are restarting apache after every change, right?

Epic555 · 02-25-2018, 11:37 PM

Quote:

Originally Posted by scasey

Add it to the Directory container you created in zabbix_icons_dir.conf in /etc/httpd/conf.d.

PS You are restarting apache after every change, right?

Sorry, i didn't understand exactly your previous reply, i read it again and got it).

When i added code to the /etc/httpd/conf.d/zabbix_icons_dir.conf, it works.
Yes of course, i restart httpd after every change.