Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there a directive to explicitly set directory listings without an index file to 403 Forbidden? The default behavior returns a 404 because mod_dir can't find the index file.

I don't have mod_autoindex loaded and Options are set to just FollowSymLinks. I tried -Indexes, but that still returned a 404.

<IfModule dir_module>
    DirectoryIndex index.php index.html index.htm
    DirectorySlash On
</IfModule>

<Directory /var/www>
    Options FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

I shouldn't matter, but I'm using Apache 2.4.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Answering my own question after a lot of trial and error. This answer should apply to Apache >= 2.0.

In summary, it seems the Indexes option for the Options directive requires mod_autoindex. You can stop reading now unless you'd like more info on the default Apache behavior.

More Info

The key is whether or not mod_autoindex is loaded. If it's not loaded, setting Options -Indexes will have no effect and return a 404, which makes sense because the mod_dir DirectoryIndex directive can't find your index file. If it is loaded, setting Options -Indexes will return a 403.

This is somewhat explained in the Apache Options docs under Indexes, which is a little confusing because Options is a part of mod_core.

Indexes

If a URL which maps to a directory is requested, and there is no DirectoryIndex (e.g., index.html) in that directory, then mod_autoindex will return a formatted listing of the directory.

... and explained on the mod_autoindex page:

Automatic index generation is enabled with using Options +Indexes. See the Options directive for more details.

My tests indicate that enabling/disabling .htaccess files with AllowOverride is irrelevant.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.
{"cc_re__cc_re__cc_by_sa_3_0": ["                  <li><a href=\"//area51.stackexchange.com\" title=\"proposing new sites in the Stack Exchange network\">Area 51</a></li>\r\n                        <li><a href=\"//careers.stackoverflow.com\">Stack Overflow Careers</a></li>\r\n                    \r\n                </ol>\r\n            </td>\r\n    </tr>\r\n</table>\r\n                </div>\r\n            </div>\r\n\r\n            <div id=\"copyright\">\r\n                site design / logo &#169; 2015 stack exchange inc; user contributions licensed under <a href=\"http://creativecommons.org/licenses/by-sa/3.0/\" rel=\"license\">cc by-sa 3.0</a> \r\n                with <a href=\"http://blog.stackoverflow.com/2009/06/attribution-required/\" rel=\"license\">attribution required</a>\r\n            </div>\r\n            <div id=\"svnrev\">\r\n                rev 2015.5.6.2556\r\n            </div>\r\n            \r\n        </div>\r\n    </div>\r\n    <noscript>\r\n        <div id=\"noscript-warning\">Server Fault works best with JavaScript enabled<img src=\"http://pixel.quantserve.com/pixel/p-c1rF4kxgLUzNc.gif\" alt=\"\" class=\"dno\"></div>\r\n    </noscri"], "copyright__copyright__copyright": ["d listing of the directory.\n\n... and explained on the mod_autoindex page:\n\nAutomatic index generation is enabled with using Options +Indexes. See the Options directive for more details.\n\nMy tests indicate that enabling/disabling .htaccess files with AllowOverride is irrelevant.\n\nshare|improve this answer\n\nYour Answer\n\n\u00a0\ndiscard\n\nBy posting your answer, you agree to the privacy policy and terms of service.\n\nNot the answer you're looking for? Browse other questions tagged or ask your own question."]}