Modifying server behaviours

Server and folder access

[Mark Wallace]

Server Version: 2.2.8-1.fc7

Hello, I'm trying to change some behaviours on my server but I have no idea how to do those changes, any sort of help will be much appreciated.

1- When someone accesses my server's IP in a browser it returns the first website I uploaded to the server, instead I'd like to show a 403 page.

2- When someone accesses a folder with a browser in any of my websites it shows that folder's entire content, for example it lists all the images on my images folders, again, I'd like to show a 403 page instead.

So far I've learned how to access files on the server through SSH and I think I've learned how to edit them with vi commands.

Thank you for your time :)

[g1smd]

1. Use a

RewriteCond

to check that

HTTP_HOST

is the value of your IP address, and use

RewriteRule .* - [F]

to block access.

2. Set

DirectoryIndex

to

OFF

.

[Mark Wallace]

Set DirectoryIndex to OFF.

I changed the value from "index.html index.html.var" to Off and the website stopped working

[g1smd]

My bad.

Options -indexes

is the one.

DirectoryIndex index.html

is correct.

I always mix that one up.

[Mark Wallace]

Don't worry, although it gave me a pretty good scare :D

Can I place

Options -Indexes

in the httpd.conf file or do I have to place it in the .htaccess file?

[jdMorgan]

Each Apache directive lists the "contexts" in which it may be used, so you might want to check the "Options" directive's valid contexts.

Jim

[edited by: jdMorgan at 3:58 pm (utc) on Sep 21, 2010]

[Mark Wallace]

Adding Options -Indexes to the .htaccess files does the trick and is much simpler and less time consuming than the only alternative that worked on the httpd.conf file.

I commented out LoadModule autoindex_module modules/mod_autoindex.so
and all the Fancy Indexing directives.

Now any directory listing returns a 404.

[jdMorgan]

With Options -Indexes, and no problems with Redirects or RewriteRules or ErrorDocument declarations, your server should be returning a 403-Forbidden response, not a 404-Not Found response.

Unless you just typed it wrong above, do not proceed without investigating this very carefully... The results of ignoring such a problem will make you very unhappy...

Look in your server error log for a report of a 404 being generated while trying to generate a 403, and use the Live HTTP Headers add-on for Firefox/Mozilla (or something similar) to check your server response headers carefully.

Jim

[Mark Wallace]

I didn't use Options -Indexes in the .htaccess files because I was trying to make this change in the httpd.conf file, I disabled the autoindex module so it wouldn't create folder directories, that's why it returns a 404.

Should I enable the autoindex module?

[Mark Wallace]

In my host (GoDaddy) Options -Indexes had to be inserted in the turbopanel.conf file to take effect, now it returns a 403. For this to be permanent it needs to be changed from +Indexes to -Indexes in the apache-config.xsl file.

The autoindex module is running again.

[jdMorgan]

Yes, you don't really need mod_autoindex at all with this configuration, but the key was to use "Options -Indexes", regardless of whether mod_autoindex was loaded or running.

Jim