Hidden/Inaccessable directories..

[davros]

Hi,
Is there any way to make a directory hidden or inaccesable through any other means but through a call on page on the server. Which will block any attempt to access these files by browser, by Bot, or by Snooping software? The only way to read these files is to access 'some.html' which will call the files by SSI or CGI. If someone tries to get the file by error or by being nosey they are denied or diverted. Even my .htaccess does not work.. If they know the filename they are looking for it's easily gotten.. It only blocks an attempt to read the directory. Or a bulk download can also grab these files easily.

Reason being is my site is modular driven. All the templates use global files through either CGI or SSI's.. Yet if someone were to happen across some of these files they would be pretty much useless since they are modules without any links, or much of anything of use without the related modules.. As well as some stuff I don't want them to access unless they access it through the proper template. Does this make sense??

I'm either looking for something CGI. I've seen some scripts that do it but I'm a hobbiest running a website for a club. We don't have allot of cash to lay out on these high dolar scripts. Plus my host provider is Linux.. Apache.. No PHP, No ASP, No Front Page, Bare bones type deal.. And at the rate they charge, and the accomidations they are willing to make on my request I hate to go anywhere else, or ask too much. Pretty much whatever I ask for they ask 'when do you want it, and how?'

I have free access to use nearly any CGI script I want.. Does anyone know of something that will do what I want?

Hopefully this makes some sort of sense.. LOL I've got the idea stuck in my brain and know exactly want I want to do it's just not easy to put it into words.

[NeedScripts]

I think .htaccess should do the job. There are tons of free and commercial *scripts* out there - or does your host not allow .htaccess ?

[bobriggs]

Not really sure here, because I can only turn on directory indexes easily because of the way my host is set up.

[httpd.apache.org...]

If the server config is set to something like:
Options Indexes
then they're turned on by default.

If your .htaccess shows Options Indexes in it, the first thing I would try is to delete the Indexes. If that doesn't work, then the host/server could have them all turned on by default, in which case you'd have to contact them. (Unless of course you are your own host)

Trying to access a directory on my host which doesn't have an index.html (or equivalent) returns a 403 (Forbidden) because I do not have that option in .htaccess

[added]
You don't really need a script. How many directories are there? Just place an index file in each one, and then in .htaccess
Redirect /thenoindexdirectory/index.html [yoursite.com...]

[bobriggs]

Oops, I totally skipped:

If someone tries to get the file by error or by being nosey they are denied or diverted. Even my .htaccess does not work.. If they know the filename they are looking for it's easily gotten.. It only blocks an attempt to read the directory. Or a bulk download can also grab these files easily.

Security through obscurity. Not good, but have you had attempts to read this/these directories?

If it's an SSI include file, probably nothing you can do. If it's a script, then I suppose you could check referer (not really good because you can block referers). These are scripts in a SSI exec or virtual call?

[davros]

Thanks, I'll try some of the sugestions.. I do have an .htaccess but it's treading on ground i'm not to sure of.. I've just noticed that even though each directory had an access file if for example if someone tries mydomain.com/directory/ they do get an error either a 403 or 404. But if filex.html is in that directory and they enter
mydomain.com/directory/filex.html it will pop up without question. Robot's don't allways follow the No Index or Dissallow in the robots text. (although they claim to be honest) as well as these apps that allow a person to actually suck down an entire site. I have a few myself. I was surprized when I ran it on my own site and got files I should not have gotten access to unless they were called from within a accessable file.

I'll try some of the sugestions here. as well as do some more research for some freebie scripts as mentioned..

[davros]

I tried the .htaccess addition. That redirects if the person tries to read the directory via index. But still if they know the filename it lets them have it.

The files are called via SSI which I tried turning the public and group permissions off. Thinking that it's the server making the call so technically, it is the administrator reading the files to impose them in the requested web page. That did not work.. I got a error while prosessing the directive. I tried a bounce script.. That didn't work. Even when I called it through SSI the way it was intended to I got redirected. Casuing a loop..

Don't get me wrong, I guess security is the wrong word here. I'm not really looking for security it's just that some of these modules are pretty useless information if not included in the document they were intended to be in. And for some reason some of them are still probed and pop up on robots even though they are not suposed to. I just don't want people comming to my site via a robot link and comming in through a dead end page and getting them confused. If I invite a visitor I want to at least try to give them what they came for. I don't want them getting lost, or discouraged, leave and not come back.

The other reason is for some sort of simple protection. I mean if someone is going to hack into the server I'm sure there are those that can do it. None of these documents are that top-secret but I would like to make it harder than just a keystroke to get them.

There has also been people with site downloaders sucking off some Java scripts which are server executed, and in an off the path directory. But since the directory/filename is listed in the src= tag it's easy for someone to just snarf the script using the filename. Here again, not to top secret but it would be nice if they asked, I'll share..

I've looked into several CGI scripts none of them seem to really do what I am looking for.. Some will, however limited to what I want to do. Others will do more but cost a fortune. All of them seem they would require a total website over haul to make them work, which is what I am trying to avoid. Oh well.. :(