security - Apache: disable directory listings

Friday, January 29, 2016

I'm using Apache 2.2.

In the var/www directory I've created a .htaccess file that contains this:

Options -indexes

When I reach my site and want to see the directories and files like this:

www.myDomainName.com/static

I get:

Forbidden

You don't have permission to access /static/ on this server

GREAT!

But, when I type the concrete IP address of my site like this:

www.ipOfMyDomainName.com/static

I get:

Index of /static/

and I can see the whole directory structure and all the files.

How can I solve this? So nobody can see my files and directories.

UPDATE: So, I'm using virtual host and I had to delete "Indexes" from the file named "default" in the site-available directory

now it contains this:


        Options FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all

Answer

Try removing "Indexes" in this line in your httpd.conf. If that doesn't work, try removing "All" too.

Options All Indexes FollowSymLinks MultiViews

Blog