Disable directory listing on apache; but access to individual files should be allowed - apache

I do not want to use .htaccess. How should I change my Directory attributes?
<VirtualHost *:80>
ServerName abc.com
DocumentRoot /usr/share/uploads
<Directory " /usr/share/uploads">
Order allow,deny
Allow from all
</Directory>
</VirtualHost>

If you are using Debian/Ubuntu, just go to terminal and type
sudo a2dismod autoindex
sudo service apache2 restart
If you are using Centos/Fedora, just do:
mv /etc/httpd/conf.d/autoindex.conf /etc/httpd/conf.d/autoindex.bkp
/etc/init.d/httpd restart
And similarly in other OS or distros...
This should disable the apache module that makes those fancy (normally useless and a security problem) directory listings. Also, as a bonus, you earn a bit of performance :-)

I really couldnt find a direct answer on internet ; even on apache documentation. Finally, could find the solution through few iterations; we need to use Options and the value should NOT contain Indexes.
<Directory "/usr/share/uploads">
Options Includes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
Allow from all
</Directory>

The #Deepak solution did not worked for me. This one did:
In the main apace configuration /etc/apache2/httpd.conf just add:
<Directory />
Options FollowSymLinks
AllowOverride All
</Directory>
And it will work for all of you domains and subdomains. Without .htaccess file.

All done above, but the directory info is still coming up?
If you use index.php, rather than index.html, Check the following:
<IfModule dir_module>
DirectoryIndex index.php
</IfModule>

on my AWS ec2, i did this and it worked for me.
First open /etc/httpd/conf/httpd.conf file.
modify/add
<Directory /var/www/html>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
</Directory>

The easiest way would be to put an empty index.html (or whatever you apache is configured to deliver by default) inside that directory.
This is not a real solution but a very simple workaround. The user browsing that directory would just see a blank white page.
Further you could use a script (like index.php) wich emulates the directory-listing and only shows some special files.

Related

Which is the correct path for AllowOverride All?

My drupal uploaded to this location /var/www/drupal
If I want to add the AllowOverride All in apache2.conf
Which is the correct path?
<Directory /var/www/drupal>
AllowOverride All
</Directory>
or
<Directory /var/www/>
AllowOverride All
</Directory>
I assume that /var/www/drupal is the directory where you copied all the Drupal files. In that case, bot the paths are correct. There is just a difference: If you have more than one Drupal installations, for example in /var/www/drupal2 and /var/www/drupal3, then I would use the first directive you shows instead of repeating the same directive for all the directories where Drupal has been installed.
As long as the AllowOverride All directive is applied to the Drupal root directory or its parent, there is no practical difference between those directive. The only difference could be if somebody is able to write an .htaccess file in /var/www without your direct control, and you don't want anything bad happening because it.

Apache Document Root adds leading default path

This should be a very simple question to answer for people who knows apache.
I have an Ubuntu computer which I use as my server. I have worked with apache several times before, but never experienced this issue.
My owncloud.conf file in the sites-enabled folder looks like this:
1 <VirtualHost *:80>¬
2 ServerName owncloud¬
3 DocumentRoot "~/mybook/ownCloud"¬
4 <Directory ~/mybook/ownCloud/>¬
5 Options None¬
6 Order deny,allow¬
7 Allow from all¬
8 </Directory>¬
9 </VirtualHost>
But after enabling the site and restarting apache, I'm getting this error:
AH00112: Warning: DocumentRoot [/etc/apache2/~/mybook/ownCloud] does not exist
I've been looking, and I cannot seem to find where it's set that "/etc/apache2/" should be leading default path to all set document roots of the site config files.
Does anyone know how I can remove this default setting?
Forget the comment I made regarding Mac, what you have above will not work. If you installed Apache on Ubuntu and accepted the defaults the docroot is /var/www and I am assuming you want your /mybook/ownCloud mapped to docroot. That is how you should do it because the httpd will run with group permissions to the real docroot. That can be done using an alias as I have below. Look at the bottom, but also note that I specified the correct default docroot in the beginning before I mapped anything. You can change the docroot but you will have to make sure the permissions on the new directory structure are set correctly.
I aliased your /mybook/ownCloud/ to ownCloud. Also, I have other directives that I removed from the sites-enabled code below for clarity.
BTW, I have personally never used tildes within an Apache conf file like you have above, it could be confusing during startup.
<VirtualHost *:80>
ServerAdmin webmaster#localhost
DocumentRoot /var/www
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
allow from all
</Directory>
Alias /owncloud/ "/mybook/ownCloud"
<Directory "/mybook/ownCloud">
Options Indexes MultiViews FollowSymLinks
AllowOverride None
Order deny,allow
Deny from all
Allow from 127.0.0.0/255.0.0.0 ::1/128
</Directory>
</VirtualHost>
EDIT:
There are other ways to configure a VHost, but this is basically how it is done. You no longer set a server wide docroot declaration in httpd.conf. The /etc/apache2/ path is the server home and in the absence of a docroot declaration in your sites-enabled it may have defaulted to Server Home when httpd started.

.htaccess rewrites not being read

I have the following in htaccess:
RewriteEngine on
RewriteRule ^list/([A-Za-z0-9_\.-]+).html?$ list.php?table=$1 [QSA,L]
In virtualhosts:
ServerName localhost
DocumentRoot "c:/wamp/www"
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all
<VirtualHost *:80>
DocumentRoot "c:/wamp/www/kurz/site/www"
ServerName kurz.local
<Directory c:/wamp/www/kurz/site/www>
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all
</Directory>
</VirtualHost>
in apache config:
DocumentRoot "c:/wamp/www/"
<Directory />
Options FollowSymLinks
AllowOverride All
Order deny,allow
Deny from all
</Directory>
Now the weird problem is:
there is a rewrite happening, even AFTER i delete the .htaccess, I tried also removing ALL other sites in the www folder, but there's still a rewrite happening from somewhere (do these things cache? i tried clearing browser cache and all that),
BUT
if I put some jibberish in the .htaccess, i get a server error, so I know it is being read!
the other problem is that the rewrite is not passing any variables,
this link works:
http://kurz.local/admin/list/pages.html
but it seems to take to:
http://kurz.local/admin/list.php
instead of
http://kurz.local/admin/list.php?table=pages
online this setup is working, but locally it's not
any ideas ?
i'm really puzzled!
You haven't mentioned if you restarted the server? editing server config files needs a restart, but I believe .htaccess file changes do not need apache server restart.
Your server doc root is:
c:/wamp/www/
Your virtual host doc root is inside the above, I don't think that is allowed.
It should be :
c:/wamp/vhosts/site1root
c:/wamp/vhosts/site2root
etc.
Also see this: https://httpd.apache.org/docs/2.2/vhosts/name-based.html

xampp - mysite.local redirects to xampp folder

I've been battering my head against this all evening and can't see where I'm going wrong. I want to set a host, mysite.local, on xampp and have followed all the instructions, but I keep getting redirected to mysite.local/xampp.
Any ideas where I'm going wrong here? The paths are correct, and I've restarted Apache :)
I edited my hosts file to add:
127.0.0.1 mysite.local
I edited extra/httpd-vhosts.conf:
NameVirtualHost localhost:80
<VirtualHost localhost:80>
ServerName localhost
DocumentRoot "/Applications/XAMPP/xamppfiles/htdocs"
<Directory "/Applications/XAMPP/xamppfiles/htdocs">
Options Indexes FollowSymLinks MultiViews
AllowOverride all
Order Deny,Allow
Allow from all
</Directory>
</VirtualHost>
<VirtualHost localhost:80>
<Directory "/Applications/XAMPP/xamppfiles/htdocs/wd">
Options Indexes FollowSymLinks MultiViews
AllowOverride all
Order Deny,Allow
Allow from all
</Directory>
DocumentRoot "/Applications/XAMPP/xamppfiles/htdocs/wd"
ServerName mysite.local
</VirtualHost>
I've just got the very same problem yesterday. Even if the steps you did are correct in a context, you need to do some more tasks ;)
You also need to edit Apach'es httpd.conf referring to your new VirtualHost like this:
# Your great site!
<Directory "/Applications/XAMPP/xamppfiles/htdocs/wd">
Options Indexes FollowSymLinks Includes ExecCGI
AllowOverride All
Order allow,deny
Allow from all
</Directory>
With this alone you'll be able to access http://mysite.local without the redirection to the XAMPP splash screen BUT you'll see the directories of your proyect (at least if you don't have and index in the root folder)
If you need to load a file from a folder (for example /public/index.php) you'll need to use an .htaccess file. Remember this file must be in the folder(s) you want to have control. So for example, an .htaccess file located at the root of your project to redirect to the /public/index.php file you must do it this way:
RewriteEngine On
RewriteBase /
RewriteRule ^.*$ public/index.php [NC,L]
Just remember to use the correct regular expression you need and don't forget to take preventive measures with more security in a production website ;) I wish I've helped you out =)

.htaccess "Options not allowed here"

I have this in my .htaccess:
Options +FollowSymLinks
And I get the following error in the apache error_log:
.htaccess: Options not allowed here
Here's the part from my httpd.conf file:
#htdocs symlinks here
<Directory /Users/you/code/my/folder>
Options All
AllowOverride All
</Directory>
<Directory />
Options All
AllowOverride All
Order allow,deny
Allow from all
</Directory>
<Directory "/Applications/XAMPP/xamppfiles/htdocs">
Options All
AllowOverride All
Order allow,deny
Allow from all
</Directory>
So I'm setting Options All and AllowOverride All everywhere, but STILL I'm not allowed to set the option. Can anyone make sense of this?
Thanks,
MrB
Note that this is a XAMPP-specific issue. XAMPP loads some additional configuration files located in XAMPP/etc/extra/ that override httpd.conf. For me the offending file is http-userdir.conf which applies rules for ~user requests and contains the line AllowOverride FileInfo AuthConfig Limit Indexes and changing that line to AllowOverride All did indeed solve my issue.
This only applies to files served from your /Sites/ directory on OS X. I don't know if the Windows version uses UserDir at all or even has a similar rule.
in my case I end up with change the line AllowOverride AuthConfig FileInfo to AllowOverride All in file httpd-vhosts.conf where this file is located in apache\conf\extra folder
You have to allow overrides for "Options" within directory context. there's no need to:
vhost/directory config:
AllowOverride All
But only to permit overrides for 'Options':
AllowOverride {Existing options to override} +Options
I guess there is a global AllowOverride setting in your apache config which disallows this. Can you grep for AllowOverride in your httpd.conf?
I just installed the most recent version of XAMPP and thought to share how I solved the same problem.
This is a XAMPP specific setting (with every new XAMPP install). The most recent up to date XAMPP as of today - XAMPP 1.8.3 have a setting in /xampp/apache/conf/extra/httpd-xampp.conf that's causing your "Server Error" message.
And then you get the following error in your error log:
.htaccess: Options not allowed here
Open /xampp/apache/conf/extra/httpd-xampp.conf and find:
<Directory "/xampp/htdocs/xampp">
<IfModule php5_module>
<Files "status.php">
php_admin_flag safe_mode off
</Files>
</IfModule>
AllowOverride AuthConfig
</Directory>
and change
AllowOverride AuthConfig
with
AllowOverride All
No authentication or authorization will be required after the change UNLESS you specify it in your httpd.conf, extra confs or in .htaccess.
You may also want to read the Apache documentation for the option AllowOverride http://httpd.apache.org/docs/current/en/mod/core.html#allowoverride and choose more optimal and secure setting that will allow you to use your .htaccess without causing a server error.
Also keep in mind that you can find a better place to rewrite the rule above depending on the results that you'd like to achieve. In my case this is a satisfactory change.
instead of changing the global AllowOverride settings in your main httpd.conf file, if you have a httpd-vhosts.conf file you would want to put directory specific AllowOverride All directives in each host entry that you need it in, so you can keep a restrictive set on the rest of the server realm.
Change Options +FollowSymLinks into Options +SymLinksIfOwnerMatch in all instances of .htaccess file, the followsymlinks has been disabled on many server due to security risk.
On Debian 9 i edited the file /etc/apache2/mods-available/userdir.conf
Disabled this line
AllowOverride FileInfo AuthConfig Limit Indexes
Added this line
Allowoverride All
And it worked fine.
Many thanks to all who contributed
Does the server your domain is hosted on fulfills all requirements needed for Elgg? Especially, is mod_rewrite available?
Re-check all steps you had done.
If mod_rewrite is working... Do you have access to the configuration (http.conf) of Apache on your server? If yes, add the following lines (adjust the path):
AllowOverride All