Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a directive to explicitly set directory listings without an index file to 403 Forbidden? The default behavior returns a 404 because mod_dir can't find the index file.

I don't have mod_autoindex loaded and Options are set to just FollowSymLinks. I tried -Indexes, but that still returned a 404.

<IfModule dir_module>
    DirectoryIndex index.php index.html index.htm
    DirectorySlash On
</IfModule>

<Directory /var/www>
    Options FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

I shouldn't matter, but I'm using Apache 2.4.

share|improve this question
1  
Im using Apache/2.4.6 on some servers and have set Options -Indexes and Dirs whitout index file return a 403, but if directory does not exist apache return a 404, maybe you are trying to access a nonexistent folder ? –  Skamasle Sep 15 '13 at 23:50
    
Interesting. No, the dir really exists. Even DirectorySlash is 301'ing me to the 404. Very strange. Do you have any mod_rewrite rules forbidding dir listings? –  Jeff Sep 15 '13 at 23:52
    
Is there a reason you need this 403 return? –  Nathan C Sep 16 '13 at 0:27
    
@jeff on some server I only put a .htaccess whit a options -Indexes on /home and all accounts (/home/user1 /home/user2 etc ) automaticly get a 403 error on dirs whitout index file. –  Skamasle Sep 16 '13 at 1:43

1 Answer 1

up vote 1 down vote accepted

Answering my own question after a lot of trial and error. This answer should apply to Apache >= 2.0.

In summary, it seems the Indexes option for the Options directive requires mod_autoindex. You can stop reading now unless you'd like more info on the default Apache behavior.

More Info

The key is whether or not mod_autoindex is loaded. If it's not loaded, setting Options -Indexes will have no effect and return a 404, which makes sense because the mod_dir DirectoryIndex directive can't find your index file. If it is loaded, setting Options -Indexes will return a 403.

This is somewhat explained in the Apache Options docs under Indexes, which is a little confusing because Options is a part of mod_core.

Indexes

If a URL which maps to a directory is requested, and there is no DirectoryIndex (e.g., index.html) in that directory, then mod_autoindex will return a formatted listing of the directory.

... and explained on the mod_autoindex page:

Automatic index generation is enabled with using Options +Indexes. See the Options directive for more details.

My tests indicate that enabling/disabling .htaccess files with AllowOverride is irrelevant.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.