Apache Indexes

SiteWorx General Discussion
1

I have a user with a user.domain.com subdomain that wants to allow virtual directory listings throughout their whole subdomain. They have a .htaccess in the html root that allows the indexes to be generated for all the directories except the bottom.

So for instance http://user.domain.com/whatever/ will show all the files in that dir, but http://user.domain.com/ shows the apache test page (or if an index.html is there, it will display the proper index.html).

I’ve searched through the apache conf for a reason for this behavior, but since I don’t know how siteworx does apache config I’m not sure what to look for. Is there any easy way to fix this behavior?

2

Can you paste the contents of the .htaccess in a post Paul?

Chris

3

Certainly:

Options All

I’m trying to make sure to cover my bases at the moment. I would prefer it to be

Options Indexes

4

I would just put an .htaccess file in the ‘html’ direction and put the following line:

Options +Indexes

That should do it since the Override for Options/Indexes is on by default with InterWorx-CP.

Chris

5

Unfortunately Options +Indexes still just shows the Apache test page at root (or, as stated before, if I put an index.html it will display that properly).

6

Just for kicks, add ‘Options +Indexes’ in the /etc/httpd/conf.d/<domain>.conf file in the VirtualHost block and restart apache.

Chris

7

Still nothing. I tried adding it in the VHost block and also in the <Directory> block. I don’t remember if the latter is valid in apache conf syntax but in any case neither worked.

8

ok, next :), try commenting out the ‘ErrorDocument’ lines in /etc/httpd/conf/httpd.conf and restarting apache.

Chris

9

No joy. Same thing.

Thank you for the prompt responses by the way. Every time I’ve asked something here I’ve gotten help nearly instantaneously!

10

Paul,

Can you get me access to this box so I can poke around. My direct email is clwells <at> nexcess.net.

Chris

11

Mail sent!

12

Figured it out Paul:


#
# Disable autoindex for the root directory, and present a
# default Welcome page if no other index page is present.
#
<LocationMatch "^/+$">
    Options -Indexes
    ErrorDocument 403 /error/noindex.html
</LocationMatch>

The previous block was disallowing indexes and showing the apache page so I commented it out.

After taking that out ‘Indexes’ was the defualt so I edited the following:


<Directory />
    Options FollowSymLinks Indexes
    AllowOverride None
</Directory>

and removed the ‘Indexes’ so that you’d have to explicitly allow indexes as you originally wanted to do.

Chris

13

Great, that comment block embarrasses me because I should have seen it, but I’m glad you figured it out. Thanks!

14

I have a client that runs a quarterly security scan on our server since they have some compliance issues they must adhere to. They found the following directory indexes:

/var/www/manual/images/
/var/www/icons/

These are both not security threats by any means but I’m trying to figure out how I can turn off indexing for them and can’t seem to have any luck. What would I need to change in the httpd.conf file to turn off indexing for these two directories? I’d prefer to turn off any directory indexing on the server unless an .htaccess file overrides it.

EDIT: I figured it out. I found where it was allowing indexing to those directories in the httpd.conf. Not sure how I didn’t see that the first time I looked.