Question

I have a website running on an Amazon EC2 Linux server, and everything works fine, but when I point the address bar to something like mydomain.com/css or mydomain.com/images, it prints out a list of all the files in that directory to the brower and they’re all readable and viewable. I tried chmod’ing some of the folders to have fewer permissions, and that prevented viewing of these files, but it also made them not appear on the site at all. Is there a way that I can protect my documents and server files while also keeping full functionality?

Answer 1

You can prevent the directory listing by disabling it in the Apache config. Just remove “Indexes” from whatever lines it appears on. For example, change from:

Options Indexes FollowSymLinks

To:

Options FollowSymLinks

Edit: Note, you can also add (or edit) the .htaccess in those directories, explicitly disabling indexing for that directory:

Options -Indexes