3

The directory I want to be hidden completely from users (site visitors) is this:

drwx------ 2 apache apache 4096 Aug 18 19:01 token

However, if I point my browser to the token directory, I can see every file in the directory and open them. What am I missing here?

I only want apache (my server) to be able to interact with this folder, as there's a cron job that requires it to have permission to read, write, and execute. Other than that, there's no need for any one or any thing to access the directory.

Improve this question
2
  • 1
    Of course you can read it. Apache has full access to the directory!
    – Michael Hampton
    Aug 20, 2015 at 0:52
  • That's what I figured, but not sure how to manage this. If I give permission to another user, then my scripts don't run correctly and the cron doesn't work. How can I get the best of both?
    – jonmrich
    Aug 20, 2015 at 0:54

1 Answer 1

Reset to default
5

From the sound of it your web server is creating a directory listing for that directory and you don't want it to.

Disable Indexes for that directory in the Apache configuration, for example:

<Directory /path/to/directory>
  Options -Indexes
</Directory>

Or search your apache configuration where +Indexes is set and remove it if you don't want directory listing enabled at all.

For more information refer to the Apache HTTPD documentation:

https://wiki.apache.org/httpd/DirectoryListings

If you want to completely disable interaction with that folder from outside of the system you can use the access control directives to restrict access. For example:

<Directory /path/to/directory>
  Order deny,allow
  Deny from all
  Allow from localhost
</Directory>

More information on access control:

http://httpd.apache.org/docs/2.2/howto/access.html

Improve this answer
4
  • 1
    Thanks! Didn't know this was a thing, but it solved my problem perfectly.
    – jonmrich
    Aug 20, 2015 at 1:37
  • 1
    This additional edit regarding denying all interactions from outside is actually exactly what I needed, but only realized it until I tested executing a file in that directory. I was hiding the index, but if you guessed a file, you could execute it. This prevents all of that. Thanks for the additional info.
    – jonmrich
    Aug 20, 2015 at 14:59
  • Any thoughts on advantages and disadvantages of this approach compared to removing read permission on the directory itself?
    – kasperd
    Aug 21, 2015 at 15:36
  • It depends on the use case. If the owner of the directory needs to be able to do a listing to find files (e.g. php or cgi script) to function setting mode 331 (-wx-wx--x) would break that. Plus if the permissions are inadvertently changed who knows how long it'll remain open for all to see before you catch it.
    – Gene
    Aug 21, 2015 at 16:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.