Onderwerp: Root Directory Listing on RH default apache

Hello everybody

[root@localhost root]# cat /etc/redhat-release
Red Hat Linux release 9 (Shrike)

# Install apache from cd or the latest one rpm
[root@localhost root]# rpm -Uvh /tmp/httpd-2.0.40-21.5.i386.rpm

==============================================
From /etc/httpd/conf/httpd.conf
#
# Disable autoindex for the root directory, and present a
# default Welcome page if no other index page is present.
#
<LocationMatch "^/$>
Options -Indexes
ErrorDocument 403 /error/noindex.html
</LocationMatch>
==============================================

It's true if you made a request like

GET / HTTP/1.0

Not true if you type:

GET // HTTP/1.0

If you have a simple index.html like

<html><body></body></html>

you aren't able to see the directory listing.
Well... a little problem but out there there are
lot of people that install default RH apache and
create "secret" (not linked) directory...
Well that's all, bye

TfM

___________________________________
-(/tmp/think_about_this:#)-> perl -e 'print 154.998 - 154,"\n"'
0.99799999999999
-(/tmp/think_about_this:#)-> perl -e 'print 154.997 - 154,"\n"'
0.997000000000014

You can fix it by changing the line to:
<LocationMatch "^/*$>

On the other hand, if youc an guess the name of any directory without
it's own index.html file, you'll still get a listing. If you're worried
about people seeing your directories, you should turn off the feature
entirely.

tfm@tfm.org wrote:
.....
> ==============================================
>>From /etc/httpd/conf/httpd.conf
> #
> # Disable autoindex for the root directory, and present a
> # default Welcome page if no other index page is present.
> #
> <LocationMatch "^/$>
> Options -Indexes
> ErrorDocument 403 /error/noindex.html
> </LocationMatch>
> ==============================================
.....
>
> It's true if you made a request like
>
> GET / HTTP/1.0
>
> Not true if you type:
>
> GET // HTTP/1.0


--
Stephen Samuel +1(604)876-0426 samuel@bcgreen.com
http://www.bcgreen.com/~samuel/
Powerful committed communication. Transformation touching
the jewel within each person and bringing it to light.

Am Dienstag, 28. Oktober 2003 09:40 schrieb Stephen Samuel:

> You can fix it by changing the line to:
> <LocationMatch "^/*$>

great idea... oops:
GET /./ HTTP/1.0

> If you're worried
> about people seeing your directories, you should turn off the feature
> entirely.
This sounds much better. Always choose a "deny everything that is not
explicitly allowed" policy.

M.


> You can fix it by changing the line to:
> <LocationMatch "^/*$>
>
> On the other hand, if youc an guess the name of any directory without
> it's own index.html file, you'll still get a listing. If you're worried
> about people seeing your directories, you should turn off the feature
> entirely.
>
> tfm@tfm.org wrote:
> ....
>
> > ==============================================
> >
> >>From /etc/httpd/conf/httpd.conf
> >
> > #
> > # Disable autoindex for the root directory, and present a
> > # default Welcome page if no other index page is present.
> > #
> > <LocationMatch "^/$>
> > Options -Indexes
> > ErrorDocument 403 /error/noindex.html
> > </LocationMatch>
> > ==============================================
>
> ....
>
> > It's true if you made a request like
> >
> > GET / HTTP/1.0
> >
> > Not true if you type:
> >
> > GET // HTTP/1.0