4

As I was testing various things to make sure my Apache installation was as secure as possible, I decided check whether I would see a directory list of files. So I created a test directory and added a couple of files:

/var/www/domain/public_html/test
/var/www/domain/public_html/test/a.txt
/var/www/domain/public_html/test/b.txt

To my surprise, when I went to that test directory, I saw a.txt and b.txt listed.

I went back to my setup file and I did have the Options -Indexes setup, so I was wondering why I would see the files a.txt and b.txt

Only my setup looked like this:

<VirtualHost domain:80>
  ...
  Options -Indexes
  ...
</VirtualHost>

Looking at the documentation for the Options command, it clearly says:

Context:    server config, virtual host, directory, .htaccess

Yet, when I put that specific option directly at the VirtualHost level, it does not do anything.

I changed the setup to move the Options in a Directory tag and it works.

<VirtualHost domain:80>
  ...
  <Directory "/var/www/domain/public_html/">
    Options -Indexes
  </Directory>
  ...
</VirtualHost>

Is that just a big Gotcha!? Something that one needs to know about to avoid NOT turning off the option one wants to turn off???

| improve this question | | | | |
  • Do you have mod_autoindex enabled? In /etc/apache2/mods-enabled/ do you see autoindex.conf and autoindex.load? If so, how about dir.conf and dir.load? I remember having to enable some module to make the -Index work on my test server, however, I do not remember which one. Both of these effect directory indexes. httpd.apache.org/docs/trunk/mod/mod_autoindex.html Cheers!! – closetnoc Oct 16 '16 at 1:52
  • @closetnoc, note that I was trying (and succeeded) in turning it off. So in that respect, I'm good. I also now fully removed the autoindex because my point of view is that it should not be there unless you really want it. What I'm super surprise about, though, is the fact that the Options did not work until I added it inside the <Directory> tag... – Alexis Wilke Oct 16 '16 at 3:13
  • Huh! Interesting. I am glad you got it. It was last year I hit a similar problem, however, I cannot remember exactly what all I had to do. I know that I had to enable a module. I just don't remember the details. Cheers!! – closetnoc Oct 16 '16 at 4:01
1

You can use Options -Indexes directly in the VirtualHost container. However, whether it will have the desired effect when defined here or not will depend on whether Options have been defined anywhere else in the server config. For instance, any <Directory> sections defined anywhere else (that relate to the directory being accessed) are likely to override this, since they are processed later in the request.

Options defined directly in the VirtualHost container will only override Options defined directly in the server config.

Since the Options directive "controls which server features are available in a particular directory", it is far more common to see this in <Directory> containers. Defining Options directly in the server config / VirtualHost is only suitable for defining a base default. However, it is common to see defaults set in a <Directory /> container in the server config which will control the entire server - an Options directive here would override any Options declared directly in the VirtualHost. (Note that "server defaults" should not be declared with the +/- prefixes, so will not be merged.)

The Apache documentation linked to in the question refers to Apache 2.4. On Apache 2.4 Indexes are not enabled by default (default: Options FollowSymLinks), so for this to be enabled on the server at all it must be explicitly defined somewhere.

On Apache 2.2 Indexes are enabled by default (default: Options All), but this can be overridden in the VirtualHost container (providing it is not defined elsewhere).

| improve this answer | | | | |
  • 1
    Ah. Now that makes much more sense. In Ubuntu 16.04, they have Options Indexes, FollowSymLinks as the default of /var/www/ defined in the /etc/apache2/apache2.conf... so a very strong default for the entire /var/www/ folder found in the main configuration file! – Alexis Wilke Oct 17 '16 at 19:21
2

I have encountered this problem in the past. Based on the help documentation strictly speaking the options -indexes directive should work in the main vhost block but in my experience and based on all examples available on how to use this directive when dealing with disabling directory indexing the directive has to be within the <Directory ""></Directory> block in the vhost file.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.