How To Disable Directory Listing in Apache?

Disabling Directory Listing in Apache is always a good practice to turn off directory listing in Apache for security reasons. This may allow users who do not have permission to view the contents of directories on your server if an index file, such as index.html, does not exist. This can expose sensitive information and might lead to security vulnerabilities. Fortunately, Apache provides several easy ways to turn off directory listing so your server's file structure is not given away to curious clients. With only a few simple configuration changes, one can make considerable improvements in Apache security.

Here are some ways to turn off directory listing in Apache:

Using the Virtual Host Configuration

If you are running multiple websites from a single Apache server by using Virtual Hosts, then you can turn off directory listing for individual Virtual Hosts.

Step 1: Open the configuration file

Open the virtual host configuration file of the site you want to configure. The files are typically located at /etc/apache2/sites-available/ or /etc/httpd/conf.d.

Step 2: Find the <VirtualHost> block

Find the <VirtualHost> block that contains your site.

Step 3: Edit the File

Add or modify the Options directive in the block of the <Directory>

<VirtualHost *:80>
    ServerName example.com
    DocumentRoot /var/www/html/example

    <Directory /var/www/html/example>
        Options -Indexes
    </Directory>
</VirtualHost>

• <VirtualHost *:80>: This sets up the configuration for the virtual host used by HTTP on port 80.
• Options -Indexes: This is a directive for turning off directory listing for the directory tree scoped within the virtual host.

Step 4: Save the file and restart Apache

sudo systemctl restart apache2

Applying Settings Globally

Step 1: Locate the Main Configuration File

Apache's main configuration file is typically located at:

• Debian/Ubuntu: /etc/apache2/apache2.conf
• CentOS/RHEL: /etc/httpd/conf/httpd.conf

Step 2: Edit the Configuration File

Open the configuration file with a text editor. For example, using nano:

sudo nano /etc/apache2/apache2.conf  # Debian/Ubuntu
sudo nano /etc/httpd/conf/httpd.conf  # CentOS/RHEL

Step 3: Add the Directory Indexing Configuration

Locate the <Directory> section or add one if it doesn’t exist. This section controls the settings for the directories. Add or modify the Options directive to disable directory listing:

<Directory /var/www/>
    Options -Indexes
</Directory>

• Replace /var/www/ with the root directory of your website if different.
• Options -Indexes disables directory listing.

Step 4: Save and Exit

Save the changes and exit the text editor:

• In nano, press Ctrl+O to write changes, then Ctrl+X to exit.

Step 5: Restart Apache

To apply the changes, restart Apache:

sudo systemctl restart apache2  # Debian/Ubuntu
sudo systemctl restart httpd    # CentOS/RHEL

Conclusion

It is a step toward improving the security of your server by changing how Apache can turn off directory listing to prevent people from viewing your directories. It's pretty easy and simple whether it is done through an .htaccess file, editing the Apache configuration files, virtual host configuration files, or global settings. Keeping directory listing disabled will help in keeping your file structure and other sensitive information private, reducing most of the security risks which could have been exploited. Once you are done setting up the server configurations, you will be better placed in reviewing and updating them often so as to maintain a most secure and robust Apache environment.