10

I need to stop directory listing of images directory on a website. I'm configuring cookieless domain for images and javascripts on a site. I have done the CNAME configuration and added below virtual hosts configuration in httpd.conf file. But, if i access this cookieless domain directly, its listing the whole directory content. how to solve this problem?

<VirtualHost ipaddr:80>
    ServerAdmin webmaster@site.com
    ServerName imgs.site.com
    ServerAlias www.imgs.site.com
    DocumentRoot /usr/tomcat/webapps/site/images

    <Directory /usr/tomcat/webapps/site/images>
       Options -Indexes FollowSymLinks
       AllowOverride none
    </Directory>

    CustomLog logs/imgs.site.com_access_log "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""
    ErrorLog logs/imgs.site.com_error_log 
</VirtualHost>

<VirtualHost ipaddr:80>
    ServerAdmin webmaster@site.com
    ServerName imgs.site.com
    ServerAlias www.imgs.site.com imgs.site.net
    DocumentRoot /usr/tomcat/webapps/site/images

    <Directory /usr/tomcat/webapps/site/images>
       Options -Indexes FollowSymLinks
       AllowOverride none
    </Directory>

    CustomLog logs/imgs.site.com_access_log "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""
    ErrorLog logs/imgs.site.com_error_log
</VirtualHost>

3 Answers 3

10
Options -Indexes FollowSymLinks

From the Apache 2.0 and Apache 2.2 docs:

Warning
Mixing Options with a + or - with those without is not valid syntax, and is likely to cause unexpected results.

In Apache 2.4 this will be...

...rejected during server startup by the syntax check with an abort.

So, you basically need a + in front of FollowSymLinks (or remove the -Indexes argument altogether if you want to override all previously defined options). For example:

Options -Indexes +FollowSymLinks
4
  • I wonder If it is necessary to use -Indexes if we don't want directory indexing done. can't we just NOT INCLUDE Indexes? and have the options like this: Options FollowSymLinks May 19, 2017 at 11:55
  • @AshishRanjan Yes, you can do it like that. But note, that that will also override any other options that might have been defined earlier in the server config (although, since this is in a VirtualHost context, that would perhaps be the better option).
    – MrWhite
    Apr 4, 2018 at 21:13
  • Okay, so a + means add and not override the existing options which may have been defined in server config! Apr 5, 2018 at 7:10
  • @AshishRanjan Yes, that's right. So, in the context of this question, we could not reliably suggest using Options FollowSymLinks, since we don't know what other options might have already been defined earlier in the server config (and might be being used).
    – MrWhite
    Apr 5, 2018 at 9:55
9

I think that path in Directory directive is appended to DocumentRoot, so you actually ordering Apache not to index /usr/tomcat/webapps/site/images/usr/tomcat/webapps/site/images. Try the following configuration instead:

DocumentRoot /usr/tomcat/webapps/site

<Directory ~ "/.*/">
    Options -Indexes
</Directory>

This should disable directory indexing in all folders under /usr/tomcat/webapps/site, eg. /usr/tomcat/webapps/site/images/, /usr/tomcat/webapps/site/fubar/ and so on.

1
  • 3
    > I think that path in Directory directive is appended to DocumentRoot << It appeared that I was wrong: "Directory-path is either the full path to a directory, or a wild-card string using Unix shell-style matching" (httpd.apache.org/docs/2.2/mod/core.html#directory). So, my example worked only because it matched every directory within the host.
    – hudolejev
    Nov 9, 2011 at 16:38
2

A quick workaround is to put an index.html file into the directory, with arbitrary content. Indexing will display the contents of this file instead of the directory listing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.