Welcome to WebmasterWorld Guest from 54.163.25.166

Forum Moderators: Ocean10000 & incrediBILL & phranque

Message Too Old, No Replies

Disabling autoindex

How do I keep Apache from creating an index for a directory?

     
12:57 am on Dec 15, 2004 (gmt 0)

New User

10+ Year Member

joined:Oct 28, 2004
posts:26
votes: 0


Apache is generating an index automagically when I try to access a directory that does not have an index file. How can I configure Apache to put up a forbidden 403 message instead?

I'd like to do this server-wide as I host several sites on the same server.

2:50 am on Dec 15, 2004 (gmt 0)

Administrator

WebmasterWorld Administrator coopster is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:July 31, 2003
posts:12533
votes: 0


Welcome to WebmasterWorld, Variable.

You'll want to learn more about Apache Module mod_autoindex [httpd.apache.org].

5:31 pm on Dec 15, 2004 (gmt 0)

New User

10+ Year Member

joined:Oct 28, 2004
posts:26
votes: 0


Coopster,

Thanks for the warm welcome and thanks for the link to the mod_autoindex documentation.

I'm relatively new to Apache. I have the read the documentation for mod_autoindex, but still seem to be unable to turn it off.

I checked my httpd.conf and can't seem to find where the autoindexing is turned on. Is it on by default? I found where it was disabled for the root directory and a placeholder page was used instead. So I see how to configure it on a directory-by-directory basis. I just don't see how to do it on a global basis.

I tried Options -Indexes with no container and that did not seem to work.

Any help would be greatly appreciated.

9:24 pm on Dec 15, 2004 (gmt 0)

Administrator

WebmasterWorld Administrator coopster is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:July 31, 2003
posts:12533
votes: 0


I checked the httpd.default.conf and yes, I believe Indexes are on by default.


Indexes 
If a URL which maps to a directory is requested, and there is no DirectoryIndex (e.g., index.html) in that directory, then mod_autoindex will return a formatted listing of the directory.

Search your httpd.conf for your default <Directory> container. The first one you will find will be the very restrictive set of features and usually right after that you will find a <Directory> container for your DocumentRoot. In there you will more than likely see the entry...

Options Indexes FollowSymLinks
...and it is there that you can remove the Indexes option.

You're right, this isn't a bad setting to change anyway. If you ever forgot to drop a DirectoryIndex file into any directory that you have created, at least folks won't get a directory listing off your server for every file in that directory.

5:48 pm on Dec 17, 2004 (gmt 0)

New User

10+ Year Member

joined:Oct 28, 2004
posts:26
votes: 0


Ok...I've now removed every instance of "Indexes" from my /etc/httpd/conf/httpd.conf file and restarted apache using /etc/rc.d/init.d/httpd restart.

I'm still getting autoindexing. I don't think it wants to die...

2:13 pm on Dec 19, 2004 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Feb 20, 2002
posts:810
votes: 0


Instead of removing every instances of Indexes, you should explicity define that indexes are not allowed..

How?

<Directory />
Options -Indexes
</Directory>

then restart:
service httpd restart

5:57 pm on Dec 20, 2004 (gmt 0)

New User

10+ Year Member

joined:Oct 28, 2004
posts:26
votes: 0


Chico_Loco,

Thank you very much for your reply. It was exactly what I was looking for. Unfortunately, it didn't work.

I did exactly what you said by adding the "-Indexes" under the directory container. I also removed all other instances of "Indexes" from the httpd.conf file.

Is there someplace besides the httpd.conf that this autoindex is configured?

8:35 pm on Dec 20, 2004 (gmt 0)

Administrator

WebmasterWorld Administrator coopster is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:July 31, 2003
posts:12533
votes: 0


The first thing that comes to mind outside of that is if you are allowing overrides and you have a per-directory override file (.htaccess) in your site directory somewhere.
9:11 pm on Dec 20, 2004 (gmt 0)

New User

10+ Year Member

joined:Oct 28, 2004
posts:26
votes: 0


I found it. There was an override in the httpd.conf file that was of the form:

Options All

I didn't catch it because it did not contain the word "Indexes". I changed it to:

Options -Indexes All

and worked like a charm. Thanks to all for your help.

I also learned that "service httpd restart" is a much easier way to do "/etc/rc.d/init.d/httpd restart" in the process!

6:21 pm on Dec 21, 2004 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Feb 20, 2002
posts:810
votes: 0


That's funny because I thought I read somewhere in the Apache docs that in order to turn of all Options you need to explitily define each and that using All wouldn't work - but that might only be for certain Options.
6:25 pm on Dec 21, 2004 (gmt 0)

Full Member

10+ Year Member

joined:Mar 8, 2004
posts:311
votes: 0


Multiviews has to be explicitly turned on, you don't get that with "All".
 

Join The Conversation

Moderators and Top Contributors

Hot Threads This Week

Featured Threads

Free SEO Tools

Hire Expert Members