Apache - Reason for Indexes Directive

[amygrant]

Looking through an IncrediblePBX install and I notice that the httpd.conf has "Options Indexes FollowSymLinks" as a directive

I am a new user but I don't understand why Indexes would be in there. Is there any reason I should leave Indexes?

To me it screams security hole and I can't see a use for it

 

[wardmundy]

The use is to provide a file listing in a web directory with no index file if memory serves me correctly. There shouldn't be a security issue since there is no Internet web exposure with Incredible PBX.

 

[amygrant]

Ok that kind of makes sense. I was going through various config files and as a long time web admin, that directive set off alarms in my head.

I like how Incredible PBX is so security conscious. Everything is closed and you open just what you need to get the job done. That's why it surprises me to see that directive. I don't see a need for it, and simply having it there for no reason opens the server to unnecessary exposure.

Example, it is assumed that piaf is sitting behind a firewall of some sort and not fully exposed to the net.However, it is still encouraged to tighten security up and give deny/permit restrictions on extensions.

I guess, to me, I'd rather not have the indexes directive. If I find a need for it, I can always loosen security and add it later. Until then, I'd rather keep my directories private, such as http://whateverdomain.com/admin/modules/

 

[wardmundy]

In addition to a hardware-based firewall, any subdirectories under /admin already are protected by a username and password. That's why we left Apache open for directory listings. We ASS-U-MEd that the use would be carefully limited already by virtue of the required password access.

P.S. I'm not arguing with you. Just explaining our thought process. You obviously can set it more securely if you want to. That's the beauty of the project.

As far as design goes, my preference always has been to leave indexes access in place. But the very first thing I do when creating a new directory is to also create a blank index.html file to "turn off" file access... unless I really want it. To me, that's much easier (unless you forget) than having to create specific access rules for directories. Different strokes for different folks as they say.

 

[amygrant]

Totally agree with you. Sorry if it seemed I was arguing, that wasn't my intention. I love nerdvittles and everything you do. I just saw something that popped out to me in the scope of things I do.

Thanks for the explanation