Disabling autoindex

How do I keep Apache from creating an index for a directory?

[Variable]

Apache is generating an index automagically when I try to access a directory that does not have an index file. How can I configure Apache to put up a forbidden 403 message instead?

I'd like to do this server-wide as I host several sites on the same server.

[coopster]

Welcome to WebmasterWorld, Variable.

You'll want to learn more about Apache Module mod_autoindex [httpd.apache.org].

[Variable]

Coopster,

Thanks for the warm welcome and thanks for the link to the mod_autoindex documentation.

I'm relatively new to Apache. I have the read the documentation for mod_autoindex, but still seem to be unable to turn it off.

I checked my httpd.conf and can't seem to find where the autoindexing is turned on. Is it on by default? I found where it was disabled for the root directory and a placeholder page was used instead. So I see how to configure it on a directory-by-directory basis. I just don't see how to do it on a global basis.

I tried Options -Indexes with no container and that did not seem to work.

Any help would be greatly appreciated.

[coopster]

I checked the httpd.default.conf and yes, I believe Indexes are on by default.

Indexes 
If a URL which maps to a directory is requested, and there is no DirectoryIndex (e.g., index.html) in that directory, then mod_autoindex will return a formatted listing of the directory.

Search your httpd.conf for your default <Directory> container. The first one you will find will be the very restrictive set of features and usually right after that you will find a <Directory> container for your DocumentRoot. In there you will more than likely see the entry...

Options Indexes FollowSymLinks

...and it is there that you can remove the Indexes option.

You're right, this isn't a bad setting to change anyway. If you ever forgot to drop a DirectoryIndex file into any directory that you have created, at least folks won't get a directory listing off your server for every file in that directory.

[Variable]

Ok...I've now removed every instance of "Indexes" from my /etc/httpd/conf/httpd.conf file and restarted apache using /etc/rc.d/init.d/httpd restart.

I'm still getting autoindexing. I don't think it wants to die...

[Chico_Loco]

Instead of removing every instances of Indexes, you should explicity define that indexes are not allowed..

How?

<Directory />
Options -Indexes
</Directory>

then restart:
service httpd restart

[Variable]

Chico_Loco,

Thank you very much for your reply. It was exactly what I was looking for. Unfortunately, it didn't work.

I did exactly what you said by adding the "-Indexes" under the directory container. I also removed all other instances of "Indexes" from the httpd.conf file.

Is there someplace besides the httpd.conf that this autoindex is configured?

[coopster]

The first thing that comes to mind outside of that is if you are allowing overrides and you have a per-directory override file (.htaccess) in your site directory somewhere.

[Variable]

I found it. There was an override in the httpd.conf file that was of the form:

Options All

I didn't catch it because it did not contain the word "Indexes". I changed it to:

Options -Indexes All

and worked like a charm. Thanks to all for your help.

I also learned that "service httpd restart" is a much easier way to do "/etc/rc.d/init.d/httpd restart" in the process!

[Chico_Loco]

That's funny because I thought I read somewhere in the Apache docs that in order to turn of all Options you need to explitily define each and that using All wouldn't work - but that might only be for certain Options.

[py9jmas]

Multiviews has to be explicitly turned on, you don't get that with "All".