logo
Apache Lounge
Webmasters

 

About Forum Index Downloads Search Register Log in RSS X


Keep Server Online

If you find the Apache Lounge, the downloads and overall help useful, please express your satisfaction with a donation.

or

Bitcoin

A donation makes a contribution towards the costs, the time and effort that's going in this site and building.

Thank You! Steffen

Your donations will help to keep this site alive and well, and continuing building binaries. Apache Lounge is not sponsored.
Post new topic   Forum Index -> Apache View previous topic :: View next topic
Reply to topic   Topic: Disable Autoindex module
Author
davidwright61



Joined: 07 Aug 2017
Posts: 1
Location: USA, OKC

PostPosted: Mon 07 Aug '17 18:57    Post subject: Disable Autoindex module Reply with quote

Hi I am new to Apache configuration. I am a web developer and I have been tasked to set up a Development and Production Apache Server running on RHEL to run a Drupal website.
I now have it up and working but now I have to secure the server we use NESSUS vulnerability scanner to to find vulnerability's in the server.
One of the scans came up with this

1.2.5 Disable Autoindex module
Info
The Apache autoindex module automatically generates web page listing the contents of directories on the server, typically used so that an index.html does not have to be generated.
Solution
Perform the following to determine if the module is enabled. Run the httpd server with the -M option to list enabled modules:
# httpd -M | grep autoindex_module


The module is there but if I go into the etc/httpd/conf.modules.d folder i find
00-base.conf when i edit this file I can go in and disable the auto index module. But when i restart Apache it fails Any one no why this happens? Am i disabling the module correctly?

Any help would be great thanks in adavance
David
Back to top
James Blond
Moderator


Joined: 19 Jan 2006
Posts: 7288
Location: Germany, Next to Hamburg

PostPosted: Sat 12 Aug '17 13:45    Post subject: Reply with quote

in the <Directory...> block from your vhost config look for Options If there is Indexes alter it to -Indexes. If there isn't indexes add -Indexes
Back to top
maba



Joined: 05 Feb 2012
Posts: 64
Location: Germany, Heilbronn

PostPosted: Fri 18 Aug '17 20:34    Post subject: Reply with quote

Another option is to do what Nessus suggest and disabling the entire module.

In your main httpd.conf look for the include of mod_autoindex and comment that out

Depending on the Linux distribution, modules might also be loaded via a separate directory (Debian / Ubuntu distributions have this). In such a case, check the appropriate command for your distribution. These commands typically work by creating or deleting symbolic links.
Back to top


Reply to topic   Topic: Disable Autoindex module View previous topic :: View next topic
Post new topic   Forum Index -> Apache