Apache directory listing question

ScreeminChikin · 06-11-2003, 08:36 AM

What directive do I have to set in Apache2 so that when a user tries to browse a folder that has just files and no index page, they get a "forbidden" message? Like if I have a folder of pictures say www.myserver.com/pictures, I dont want it to list the folder contents. I only want to allow accesss if the user knows the specific name of a file like www.myserver.com/pictures/mypicture.jpg . It seems that it was like this by default in apache 1.3 but on my Apache2 box it will generate a directory listing instead of the "forbidden" page.

unSpawn · 06-13-2003, 04:43 AM

If this is still an issue, check your directives for where it automagically generates dir indexes and turn that off.

jini555 · 12-23-2003, 06:20 PM

i would like the answer to this question as well. I need to know what options to set for the Directory directive.

trickykid · 12-23-2003, 06:42 PM

Quote:

Originally posted by jini555
i would like the answer to this question as well. I need to know what options to set for the Directory directive.

In your httpd.conf file you will see something like:

Code:

# This may also be "None", "All", or any combination of "Indexes",
# "Includes", "FollowSymLinks", "ExecCGI", or "MultiViews".
#
# Note that "MultiViews" must be named *explicitly* --- "Options All"
# doesn't give it to you.
#
    Options Indexes FollowSymLinks MultiView

To disable Indexing, just remove Indexes after the Options listed above.

Cheers.

robertoneto123 · 02-10-2004, 05:04 AM

I tryied to follow your tip, but it does not work...

Is the code bellow wrong?

Code:

<Directory />
  Options -All Multiviews Indexes FollowSymLinks
  AllowOverride None
  <IfModule mod_access.c>
    Order deny,allow
    Deny from all
  </IfModule>
</Directory>

totalnuke · 04-14-2004, 06:17 AM

c'mon isn't there anyone with a working solution ?
I was trying to find an answer for a whole night, if anyone out there has this working on linux box (win ans linux conf files are different) please post.

here is original version of httpd2.conf:

Code:

# First, we configure the "default" to be a very restrictive set of 
# permissions.  
#
# Also, for security, we disable indexes globally
#
#<Directory />
#    Options -Indexes FollowSymLinks
#    AllowOverride None
#</Directory>

#Restricted set of options 
<Directory />
  Options +All -Multiviews
  AllowOverride None
  <IfModule mod_access.c>
    Order deny,allow
    Deny from all
  </IfModule>
</Directory>

totalnuke · 04-15-2004, 02:33 AM

well, i've got a solution myself, as it is pretty important thing for me. Just use Apache 1.3, at least I never had a problem with it.