Welcome to WebmasterWorld Guest from 54.159.190.106

Forum Moderators: Ocean10000 & incrediBILL & phranque

Message Too Old, No Replies

Disabling autoindex

How do I keep Apache from creating an index for a directory?

   
12:57 am on Dec 15, 2004 (gmt 0)

10+ Year Member



Apache is generating an index automagically when I try to access a directory that does not have an index file. How can I configure Apache to put up a forbidden 403 message instead?

I'd like to do this server-wide as I host several sites on the same server.

2:50 am on Dec 15, 2004 (gmt 0)

WebmasterWorld Administrator coopster is a WebmasterWorld Top Contributor of All Time 10+ Year Member



Welcome to WebmasterWorld, Variable.

You'll want to learn more about Apache Module mod_autoindex [httpd.apache.org].

5:31 pm on Dec 15, 2004 (gmt 0)

10+ Year Member



Coopster,

Thanks for the warm welcome and thanks for the link to the mod_autoindex documentation.

I'm relatively new to Apache. I have the read the documentation for mod_autoindex, but still seem to be unable to turn it off.

I checked my httpd.conf and can't seem to find where the autoindexing is turned on. Is it on by default? I found where it was disabled for the root directory and a placeholder page was used instead. So I see how to configure it on a directory-by-directory basis. I just don't see how to do it on a global basis.

I tried Options -Indexes with no container and that did not seem to work.

Any help would be greatly appreciated.

9:24 pm on Dec 15, 2004 (gmt 0)

WebmasterWorld Administrator coopster is a WebmasterWorld Top Contributor of All Time 10+ Year Member



I checked the httpd.default.conf and yes, I believe Indexes are on by default.


Indexes 
If a URL which maps to a directory is requested, and there is no DirectoryIndex (e.g., index.html) in that directory, then mod_autoindex will return a formatted listing of the directory.

Search your httpd.conf for your default <Directory> container. The first one you will find will be the very restrictive set of features and usually right after that you will find a <Directory> container for your DocumentRoot. In there you will more than likely see the entry...

Options Indexes FollowSymLinks
...and it is there that you can remove the Indexes option.

You're right, this isn't a bad setting to change anyway. If you ever forgot to drop a DirectoryIndex file into any directory that you have created, at least folks won't get a directory listing off your server for every file in that directory.

5:48 pm on Dec 17, 2004 (gmt 0)

10+ Year Member



Ok...I've now removed every instance of "Indexes" from my /etc/httpd/conf/httpd.conf file and restarted apache using /etc/rc.d/init.d/httpd restart.

I'm still getting autoindexing. I don't think it wants to die...

2:13 pm on Dec 19, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Instead of removing every instances of Indexes, you should explicity define that indexes are not allowed..

How?

<Directory />
Options -Indexes
</Directory>

then restart:
service httpd restart

5:57 pm on Dec 20, 2004 (gmt 0)

10+ Year Member



Chico_Loco,

Thank you very much for your reply. It was exactly what I was looking for. Unfortunately, it didn't work.

I did exactly what you said by adding the "-Indexes" under the directory container. I also removed all other instances of "Indexes" from the httpd.conf file.

Is there someplace besides the httpd.conf that this autoindex is configured?

8:35 pm on Dec 20, 2004 (gmt 0)

WebmasterWorld Administrator coopster is a WebmasterWorld Top Contributor of All Time 10+ Year Member



The first thing that comes to mind outside of that is if you are allowing overrides and you have a per-directory override file (.htaccess) in your site directory somewhere.
9:11 pm on Dec 20, 2004 (gmt 0)

10+ Year Member



I found it. There was an override in the httpd.conf file that was of the form:

Options All

I didn't catch it because it did not contain the word "Indexes". I changed it to:

Options -Indexes All

and worked like a charm. Thanks to all for your help.

I also learned that "service httpd restart" is a much easier way to do "/etc/rc.d/init.d/httpd restart" in the process!

6:21 pm on Dec 21, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



That's funny because I thought I read somewhere in the Apache docs that in order to turn of all Options you need to explitily define each and that using All wouldn't work - but that might only be for certain Options.
6:25 pm on Dec 21, 2004 (gmt 0)

10+ Year Member



Multiviews has to be explicitly turned on, you don't get that with "All".
 

Featured Threads

Hot Threads This Week

Hot Threads This Month