You can put it anywhere in any of those files.
But the reason why one puts one thing in one file versus another is up to you.
Okay, so this stuff is confusing when you first encounter it, but it’s simple as well. Here is a breakdown.
httpd.conf is 100% the same as
apache2.conf. The only difference is that
/etc/httpd/httpd.conf is what RedHat/CentOS uses and
/etc/apache2/apache2.conf is what Debian/Ubuntu uses.
Next, what is
/var/www/html/.htaccess? Good question and here are the answers.
This is the root/parent Apache config file. If you are 100% sure that the Apache server on that machine should never do directory listings no matter what, just set this in there. This will set defaults for the server and all virtual hosts on the machine:
Restart Apache via
sudo service apache2 restart and you are good to go.
This is the virtual host default config for the Apache server. The main difference between
/etc/apache2/apache2.conf and this config is this
000-default.conf is typically the place where people put tweaks and adjustments specific to their server. The benefit is that it is short and sweet and can only be a few lines of config if needed. The negative aspect of this is if you are using virtual hosts, the settings in here would be ignored by another virtual host config. But if you are 100% sure you are only using Apache for one host on your setup, this is fine.
I personally think this is the best place to do something like that. As long as your main
/etc/apache2/apache2.conf is set to
AllowOverride All (which is what enables
.htaccess) this will be the simplest to maintain. Mainly because adjustments to
000-default.conf and anything in
/etc/apache2/ will require and admin/root user to restart Apache.
Some old school developers might say that using
.htaccess is not a good idea because it will force Apache to load that file on each page load, but on modern systems this is a trivial to non-existent issue. You might save a fraction of a fraction of a fraction of a second on page load if you don’t use
.htaccess, but that is meaningless nowadays.
If you choose to use it in
.htaccess there is no need to do something like define it in
<Directory /var/www/html/> and such. Just create a file called
.htaccess and make this the contents:
Save it and you are good. Of course, if someone removes, renames or messes around with that file and changes it to
Options +Indexes directory listings are happening again. But like I said, all these config options depend on need and use; and there is no one best/authoritative way to do this.
But hopefully these options give you ideas on how to approach disabling directory listings in Apache.
Also, regarding the hierarchy of what happens where, if you have a setting in
apache2.conf and then you have another setting in
000-default.conf and yet another setting in
.htaccess then the final edit in
.htaccess is what matters. You basically want to set all of your reasonable and broad systemwide configs in
000-default.conf and then leave the site specific stuff in
What matters is the last setting. It’s a cascading pile of settings and honestly everything could be in
apache2.conf but the configs are just split to make your life easier. Instead of one massive monolithic config you could split things out into small files.