[SOLVED] How to disable directory indexing ?

naruponk · 05-04-2010, 02:30 AM

Hi

I'm concerning about my web server, I use nikto to see where should I improve my configurations, then I just know my web server is enable directory indexing.

I have searched and found that I should just put

Code:

Options -Indexes

to disable directory indexing.
I have already restart apache but directory indexing still enable
here is my httpd.conf Where did I wrong ?

Code:

ServerTokens OS
ServerRoot "/etc/httpd"
PidFile run/httpd.pid
Timeout 120

KeepAlive Off

MaxKeepAliveRequests 100

KeepAliveTimeout 15

<IfModule prefork.c>
StartServers       8
MinSpareServers    5
MaxSpareServers   20
ServerLimit      256
MaxClients       256
MaxRequestsPerChild  4000
</IfModule>

<IfModule worker.c>
StartServers         2
MaxClients         150
MinSpareThreads     25
MaxSpareThreads     75 
ThreadsPerChild     25
MaxRequestsPerChild  0
</IfModule>

Listen 80

Include conf.d/*.conf

User apache
Group apache

ServerAdmin root@localhost

UseCanonicalName Off

<Directory />
    Options -Indexes FollowSymLinks
    AllowOverride None
</Directory>

<Directory "/var/www/docs">
    Options -Indexes FollowSymLinks

    AllowOverride None

    Order allow,deny
    Allow from all

</Directory>

<IfModule mod_userdir.c>
    UserDir disable
</IfModule>


DirectoryIndex index.html index.html.var

AccessFileName .htaccess

<Files ~ "^\.ht">
    Order allow,deny
    Deny from all
</Files>

TypesConfig /etc/mime.types

DefaultType text/plain

HostnameLookups Off

ErrorLog logs/error_log

ServerSignature On

Alias /icons/ "/var/www/icons/"

<Directory "/var/www/icons">
    Options -Indexes MultiViews
    AllowOverride None
    Order allow,deny
    Allow from all
</Directory>

<IfModule mod_dav_fs.c>
    # Location of the WebDAV lock database.
    DAVLockDB /var/lib/dav/lockdb
</IfModule>

ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"

<Directory "/var/www/cgi-bin">
    AllowOverride None
    Options None
    Order allow,deny
    Allow from all
</Directory>

IndexOptions FancyIndexing VersionSort NameWidth=* HTMLTable

AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip


DefaultIcon /icons/unknown.gif
ReadmeName README.html
HeaderName HEADER.html
IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t

ForceLanguagePriority Prefer Fallback

AddDefaultCharset UTF-8

AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz

AddHandler type-map var

AddType text/html .shtml
AddOutputFilter INCLUDES .shtml

Alias /error/ "/var/www/error/"

<IfModule mod_negotiation.c>
<IfModule mod_include.c>
    <Directory "/var/www/error">
        AllowOverride None
        Options IncludesNoExec
        AddOutputFilter Includes html
        AddHandler type-map var
        Order allow,deny
        Allow from all
        LanguagePriority en es de fr
        ForceLanguagePriority Prefer Fallback
    </Directory>

</IfModule>
</IfModule>

TraceEnable off
NameVirtualHost *:80

<VirtualHost *:80>
DocumentRoot /var/www/docs/abc.com
<Directory /var/www/docs/abc.com>
allow from all
Options -Indexes
</Directory>
ServerName www.abc.com
</VirtualHost>

smoker · 05-04-2010, 03:12 AM

Have you tested it on your server ?
can you see inside a directory ?

How do you know it's still enabled ?

Nothing in your conf suggests that it is enabled.

If you are using Apache2 check the modules directory for something that's setting indexes
/etc/apache2/mods-available/

naruponk · 05-04-2010, 03:36 AM

I'm currently test with nikto, how can I test is it still enable or disabled ?

I create a new folder named as beta and nikto said /beta ... this might be interesting, I though It can see what folder inside my site

How can I check myself ?

smoker · 05-04-2010, 04:07 AM

open it in a browser.
You are running a web server ?

naruponk · 05-04-2010, 04:45 AM

Yes, i'm running web server.
I have tried to open in a browser it said
You don't have permission to access /beta/ on this server.
but how can they know I have folder that name ?

So, Are there any other way to list folder ?

smoker · 05-04-2010, 04:51 AM

So it's not giving directory listings.
Of course it can see there is a folder there, otherwise you would not be able to open a page within that folder.

Web servers are set up by default so that the world can see anything you put on the server (inside the document root). If you want to keep things private, you either change the directory permissions to 750 or password protect it. Don't do that to the document root, or no one will be able to see any pages from a browser, including you.

naruponk · 05-04-2010, 05:21 AM

Thanks a lot !!!