When you don't have an index.html, most web servers will show a list of files in the directory.

Can I get preferably lighttpd (but Apache as a backup) to do show a file's MD5/SHA1 (along with standard file size, date) with no (or minimal) other programs involved? If so, how? (Debian on a very very low RAM VPS is the reason.)


Apache and Lighthttpd both have a directory listing mod that you need to enable, often by default these are disabled for security reasons. You can enable indexing by doing the following:


To enable directory listings globally:

dir-listing.activate = "enable"

If you need it only for a directory, use conditionals:

$HTTP["url"] =~ "^/download($|/)" {
     dir-listing.activate = "enable" 


To enable directory listings globally:

<Directory /usr/local/apache2/htdocs/listme>
  Options +Indexes


Directory indexing in both Apache2 and Lighthttpd do not support MDA SHA file hasing, its a simple directory view that allows you to download files, nothing more. You will need to use a PHP file manager or make your own using PHP MD5 File script. It's not a straight forward topic and your have to do some research, or pay for hosting with management.

  • ah, so it looks like PHP is required. thanks! i wanted to try to avoid PHP as an attack vector if i didn't keep up to the day/week/month on patching the server. – plonk420 Aug 18 '15 at 7:45

To write a custom listing, you need to write a script, but PHP is not the only scripting language, and is not one of the more secure scripting languages. However, no matter what scripting language you choose, if you are not careful to write a secure script, then the script will be insecure (regardless of the language). If you merely want a textual list of files, you could write a shell script called index.sh that looks something like:

echo "Status: 200"
echo "Content-Type: text/plain"
sha256sum *

Assuming that the files do not change frequently, it would be more efficient to write a script that you run once a day to calculate the digests and to write out a static index.html of the directory index.

  • You would normally want the file name in a directory listing to be linked. This solution won't do that. It could be used in cases where just a list is needed with no download links. – Stephen Ostermiller Nov 14 '20 at 11:21
  • My answer is simple and addresses the original post. If you have further requirements, feel free to change the content type to text/html and to write a few more lines of code to loop the sha256sum output and generate links. – gstrauss Nov 15 '20 at 10:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.