forbidden if no index file

[kurkulis]

Hi to all!
i wanted to ask, how to configure apache to check if there is index file in directory, if not then show forbidden message (but not to list all files in that directory)
p.s. apache on linux if thats makes some difference

thanks

 

[smah]

There are several possible ways to do this. The apache package included with most linux distros are set up to do this when they are first installed - but instead of displaying a forbidden message, they display a welcome message.

http.conf would have an Include directive like this (your installation probably has this already):

# Load config files from the config directory "/etc/httpd/conf.d".
#
Include conf.d/*.conf

The included conf directory would have a welcome.conf like:

#
# This configuration file enables the default "Welcome"
# page if there is no default index page present for
# the root URL. To disable the Welcome page, comment
# out all the lines below.
#
<LocationMatch "^/+$">
Options -Indexes
ErrorDocument 403 /error/noindex.html
</LocationMatch>

So, you could simply change the ErrorDocument to whatever you'd like. Instead of the typical 'welcome.conf' you could name the .conf file to something more suitable. Or you could simply add these directives directly to your httpd.conf file without the separate .conf file.

 

[RhythmAce]

For security, you should have an index in each of the directories or a mechanism such as the one smah discussed to keep people from seeing your directory structure. Smah's suggestion is the best way but if you put an index in each directory, they can be as simple as telling people they don't belong there and to go away. Maybe even display their ip address to discourage them from poking around any further. This way can get quite tedious though if you have a lot of directories.

 

[kurkulis]

thanks to smah and RhythmAce excelent idea!

 

[smah]

can be as simple as telling people they don't belong there and to go away

Funny that you should mention that- Not long ago, on a test server I was messing around with something (a CMS maybe) and tried to directly access a lower level folder that I shouldn't have access to. The 'error' [simply a php generated index.html] page was something like: Got your hand caught in the cookie jar, didn't you? It cracked me up at the time & I forgot about it until you reminded me.