How to turn off index viewing by default in EA?

[dwh2]

I don't want people to be able to surf directories by default if there's no index.html file in a directory. I thought I set that up somewhere in WHM, but I guess not.

I notice that EA3 builds Apache with this directive:

<Directory "/usr/local/apache/htdocs">
    Options Indexes FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all

</Directory>

If I want it turned off, do I just remove "Indexes" above and run that cpanel program to register the change? Or is it somewhere else?

Also, may I add a feature request that you add this option into the EA3 builder so we can turn indexes on/off in the httpd.conf by default and let the users override our serverwide default... For security I think directory browsing off would be better.

P.S. a similar suggestion would be not to default ServerTokens FULL as default...although I changed it to Prod and checked in a server headers tool and it's still showing my PHP version for some reason...

 

[cPanelDavidG]

Individual account owners can turn off index viewing by going to cPanel -> Advanced -> Index Manager.

 

[dwh2]

OK, how about the reverse...turning it off by default serverwide? That's what I was looking for.

 

[jayh38]

in the servers /home create a .htaccess with the following:

Options All -Indexes

 

[dwh2]

Thanks...so just /home/.htaccess and it will propagate to the directories below it?

Wow, cool.

 

[jayh38]

Yep you got it..

 

[jamesbond]

If you enable index viewing by default, why not give people the option to turn off index viewing when compiling apache?

Don't most hosts/server owners have indexing turned off for security reasons? Why enable it server wide by default if generally only a handful of users on a server might actually be interested in it. IMO it makes more sense to disable it by default and have the few users that need it enable it in their own cpanel account.

 

[cPanelDavidG]

If you enable index viewing by default, why not give people the option to turn off index viewing when compiling apache?

Don't most hosts/server owners have indexing turned off for security reasons? Why enable it server wide by default if generally only a handful of users on a server might actually be interested in it. IMO it makes more sense to disable it by default and have the few users that need it enable it in their own cpanel account.

That sounds like a good idea for an official feature request. You can submit official feature requests to http://bugzilla.cpanel.net

 

[mstuebner]

That sounds like a good idea for an official feature request. You can submit official feature requests to http://bugzilla.cpanel.net

Wow, isn't that a bit too big, instead of just modifying the vhost templates and to add -Indexes to Options?

 

[dwh2]

That sounds like a good idea for an official feature request. You can submit official feature requests to http://bugzilla.cpanel.net

That's what I meant to say in the first post.

 

[forlinuxsupport]

bugzilla

I couldn't find an bugzilla for it so I created a new one -

http://bugzilla.cpanel.net/show_bug.cgi?id=7425

cheers
Andy

 

[cesare]

in the servers /home create a .htaccess with the following:

Options All -Indexes

Im fairly new to this, but I have the understanding that using .htaccess files will create a recursive search through the subdirectories.
Could someone more knowledgeable please elaborate on the consequences, compared to using a directive instead?