Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am a complete apache and co newb. Currently it serves only the default page. On the default page, the user can not list the directory or files. When I create a directory, say

/var/www/foobar

and place files in it, the user can by doing:

 www.mydomain.org/foobar

see the contents of the directory. I run pretty much the default configuration. on Directory "/", I have FollowSymlinks and AllowOverride(none) on what DocumentRoot points to I have Indexes FollowSymlinks MultiViews and "allow from all" set.

My questions are:

  1. Can I stop people from listing subdirectories?
  2. Can people, if I do not change the configuration, in some way read the php files in there? (I mean not the rendered page, I mean the .php page source.)

Pointers to good resources about this would also be nice.

Thx in Advance.

share|improve this question
1  
Perhaps this should be on serverfault instead? Also, knowing which distribution of linux would be helpful. – wag2639 May 18 '10 at 21:00
    
Yes, you are right. Sorry, but I got confused with all the different sites. I usually only use stackoverflow. My bad. – AndreasT May 20 '10 at 10:45
up vote 1 down vote accepted
  1. Yes, you can stop the SERVER from listing files in a folder. Read about apaches mod_dir.

  2. Maybe, if your server supports PHP and has it enabled, it shouldn't displayed the source code. It should display the rendered PHP script.

Also, I like using AskApache as a guide but Google is a lifesaver, too.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .