1

I've read quite a bit about this and i'm starting to get a bit confused on which is the right way to do this.

I don't have an httpd.conf file, however i do have an apache2.conf file located here: /etc/apache2/apache2.conf

<Directory /var/www/html/>
    Options -Indexes
</Directory>

(notating the directory)

Additionally the standard sites-available here: /etc/apache2/sites-available/000-default.conf

So which file should I add the contents of below?

<Directory />
    Options -Indexes
</Directory>

(no need to notate the directory if it goes here, correct?)

Also inside the 000-default.conf file it has directory like 5 times like so...

<Directory />
        Options FollowSymLinks
        AllowOverride None
        Require all denied
</Directory>

<Directory /usr/share>
        AllowOverride None
        Require all granted
</Directory>

<Directory /var/www/>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

So could I edit one of those or do I have to do something completely different in like .htaccess? Which I believe would work too.

1

You can put it anywhere in any of those files.

But the reason why one puts one thing in one file versus another is up to you.

Okay, so this stuff is confusing when you first encounter it, but it’s simple as well. Here is a breakdown.

First, httpd.conf is 100% the same as apache2.conf. The only difference is that /etc/httpd/httpd.conf is what RedHat/CentOS uses and /etc/apache2/apache2.conf is what Debian/Ubuntu uses.

Next, what is /etc/apache2/apache2.conf versus /etc/apache2/sites-available/000-default.conf versus /var/www/html/.htaccess? Good question and here are the answers.


/etc/apache2/apache2.conf

This is the root/parent Apache config file. If you are 100% sure that the Apache server on that machine should never do directory listings no matter what, just set this in there. This will set defaults for the server and all virtual hosts on the machine:

<Directory /var/www/html/>
    Options -Indexes
</Directory>

Restart Apache via sudo service apache2 restart and you are good to go.

/etc/apache2/sites-available/000-default.conf

This is the virtual host default config for the Apache server. The main difference between /etc/apache2/apache2.conf and this config is this 000-default.conf is typically the place where people put tweaks and adjustments specific to their server. The benefit is that it is short and sweet and can only be a few lines of config if needed. The negative aspect of this is if you are using virtual hosts, the settings in here would be ignored by another virtual host config. But if you are 100% sure you are only using Apache for one host on your setup, this is fine.

/var/www/html/.htaccess

I personally think this is the best place to do something like that. As long as your main /etc/apache2/apache2.conf is set to AllowOverride All (which is what enables .htaccess) this will be the simplest to maintain. Mainly because adjustments to apache2.conf and 000-default.conf and anything in /etc/apache2/ will require and admin/root user to restart Apache.

Some old school developers might say that using .htaccess is not a good idea because it will force Apache to load that file on each page load, but on modern systems this is a trivial to non-existent issue. You might save a fraction of a fraction of a fraction of a second on page load if you don’t use .htaccess, but that is meaningless nowadays.

If you choose to use it in .htaccess there is no need to do something like define it in <Directory /var/www/html/> and such. Just create a file called .htaccess and make this the contents:

Options -Indexes

Save it and you are good. Of course, if someone removes, renames or messes around with that file and changes it to Options +Indexes directory listings are happening again. But like I said, all these config options depend on need and use; and there is no one best/authoritative way to do this.

But hopefully these options give you ideas on how to approach disabling directory listings in Apache.

Also, regarding the hierarchy of what happens where, if you have a setting in apache2.conf and then you have another setting in 000-default.conf and yet another setting in .htaccess then the final edit in .htaccess is what matters. You basically want to set all of your reasonable and broad systemwide configs in apache2.conf or 000-default.conf and then leave the site specific stuff in .htaccess.

What matters is the last setting. It’s a cascading pile of settings and honestly everything could be in apache2.conf but the configs are just split to make your life easier. Instead of one massive monolithic config you could split things out into small files.

  • Fantastic description of what each does, thanks @JakeGould. – Supplement Sep 4 at 22:57
  • Oh, one last question if i may. I'm probably just going to keep my edit in apache2.conf so this will override all the other virtual host stuff going on in 000-default.conf because it supersedes that file, correct? – Supplement Sep 4 at 22:59
  • Never mind i think you said above "and for all virtual hosts on the machine" .... yep.. so i think that covers it... – Supplement Sep 4 at 23:03
  • @Supplement Nope. If you have a setting in apache2.conf and then you have another setting in 000-default.conf and yet another setting in .htaccess then the final edit in .htaccess is what matters. You basically want to set all of your reasonable and broad systemwide configs in apache2.conf or 000-default.conf and then leave the site specific stuff in .htaccess. – JakeGould Sep 4 at 23:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.