homepage Welcome to WebmasterWorld Guest from 54.198.94.76
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Become a Pro Member
Home / Forums Index / Code, Content, and Presentation / Apache Web Server
Forum Library, Charter, Moderators: Ocean10000 & incrediBILL & phranque

Apache Web Server Forum

    
Disabling autoindex
How do I keep Apache from creating an index for a directory?
Variable




msg:1518873
 12:57 am on Dec 15, 2004 (gmt 0)

Apache is generating an index automagically when I try to access a directory that does not have an index file. How can I configure Apache to put up a forbidden 403 message instead?

I'd like to do this server-wide as I host several sites on the same server.

 

coopster




msg:1518874
 2:50 am on Dec 15, 2004 (gmt 0)

Welcome to WebmasterWorld, Variable.

You'll want to learn more about Apache Module mod_autoindex [httpd.apache.org].

Variable




msg:1518875
 5:31 pm on Dec 15, 2004 (gmt 0)

Coopster,

Thanks for the warm welcome and thanks for the link to the mod_autoindex documentation.

I'm relatively new to Apache. I have the read the documentation for mod_autoindex, but still seem to be unable to turn it off.

I checked my httpd.conf and can't seem to find where the autoindexing is turned on. Is it on by default? I found where it was disabled for the root directory and a placeholder page was used instead. So I see how to configure it on a directory-by-directory basis. I just don't see how to do it on a global basis.

I tried Options -Indexes with no container and that did not seem to work.

Any help would be greatly appreciated.

coopster




msg:1518876
 9:24 pm on Dec 15, 2004 (gmt 0)

I checked the httpd.default.conf and yes, I believe Indexes are on by default.


Indexes
If a URL which maps to a directory is requested, and there is no DirectoryIndex (e.g., index.html) in that directory, then mod_autoindex will return a formatted listing of the directory.

Search your httpd.conf for your default <Directory> container. The first one you will find will be the very restrictive set of features and usually right after that you will find a <Directory> container for your DocumentRoot. In there you will more than likely see the entry...

Options Indexes FollowSymLinks
...and it is there that you can remove the Indexes option.

You're right, this isn't a bad setting to change anyway. If you ever forgot to drop a DirectoryIndex file into any directory that you have created, at least folks won't get a directory listing off your server for every file in that directory.

Variable




msg:1518877
 5:48 pm on Dec 17, 2004 (gmt 0)

Ok...I've now removed every instance of "Indexes" from my /etc/httpd/conf/httpd.conf file and restarted apache using /etc/rc.d/init.d/httpd restart.

I'm still getting autoindexing. I don't think it wants to die...

Chico_Loco




msg:1518878
 2:13 pm on Dec 19, 2004 (gmt 0)

Instead of removing every instances of Indexes, you should explicity define that indexes are not allowed..

How?

<Directory />
Options -Indexes
</Directory>

then restart:
service httpd restart

Variable




msg:1518879
 5:57 pm on Dec 20, 2004 (gmt 0)

Chico_Loco,

Thank you very much for your reply. It was exactly what I was looking for. Unfortunately, it didn't work.

I did exactly what you said by adding the "-Indexes" under the directory container. I also removed all other instances of "Indexes" from the httpd.conf file.

Is there someplace besides the httpd.conf that this autoindex is configured?

coopster




msg:1518880
 8:35 pm on Dec 20, 2004 (gmt 0)

The first thing that comes to mind outside of that is if you are allowing overrides and you have a per-directory override file (.htaccess) in your site directory somewhere.

Variable




msg:1518881
 9:11 pm on Dec 20, 2004 (gmt 0)

I found it. There was an override in the httpd.conf file that was of the form:

Options All

I didn't catch it because it did not contain the word "Indexes". I changed it to:

Options -Indexes All

and worked like a charm. Thanks to all for your help.

I also learned that "service httpd restart" is a much easier way to do "/etc/rc.d/init.d/httpd restart" in the process!

Chico_Loco




msg:1518882
 6:21 pm on Dec 21, 2004 (gmt 0)

That's funny because I thought I read somewhere in the Apache docs that in order to turn of all Options you need to explitily define each and that using All wouldn't work - but that might only be for certain Options.

py9jmas




msg:1518883
 6:25 pm on Dec 21, 2004 (gmt 0)

Multiviews has to be explicitly turned on, you don't get that with "All".

Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Code, Content, and Presentation / Apache Web Server
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved