Disable Apache Directory Listing on Ubuntu 24.04

Disable directory listing

Editing the main Apache configuration file at `/etc/apache2/apache2.conf` disables directory listing across the entire server. Global parameters dictate how Apache handles every hosted website simultaneously. Apache web servers running on Ubuntu 24.04 ship with directory listing enabled by default, exposing directory contents whenever an index file is missing.

Modifying the relevant block removes the `Indexes` keyword from the `Options` directive. Securing content within `/var/www/` requires changing the configuration block, saving the file, and restarting the service. Reverting this change involves adding `Indexes` back to the `Options` line.

Run the command below to open the global configuration file.

sudo nano /etc/apache2/apache2.conf

This block, featuring the ‘Indexes‘ option, activates directory listing for Apache’s default root directory (/var/www).

<Directory /var/www/>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

Restricting directory listing for all content within the /var/www/ default directory requires modifying the block as shown below.

<Directory /var/www/>
        Options FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

Save and exit the file.

Restart Apache to apply the new configuration.

Re-enabling directory listing happens at any time by adding 'Indexes' back into the configuration.

Disable directory listing selectively

Disabling Apache directory listing for selective websites requires inserting specific rules into individual site configuration files. This localized approach bypasses global server settings, granting precise control over individual web directories.

Review this example of a website configuration implementing the restriction.

<VirtualHost *:80>
  ServerName banking.example.com
  ServerAdmin admin@example.com
  DocumentRoot /var/www/banking
    
  <Directory /var/www/banking/>
       Options FollowSymlinks
       AllowOverride All
       Require all granted
  </Directory>

       ErrorLog ${APACHE_LOG_DIR}/error.log
       CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

This configuration restricts behavior specifically for the /var/www/banking/ website within the broader Apache directory structure.

The server is now fully secured.

Conclusion:

• Enabling or disabling Apache directory listing is crucial for maintaining server security.
• Disabling directory listing prevents unauthorized access to files and sensitive information within directories.
• Users without an index file will encounter a 403 Forbidden error, enhancing security.
• Configurations can be made globally or selectively for individual websites, providing flexibility.
• Always restart Apache after making changes to ensure they take effect.
• Regularly review and update your server configurations to keep security measures current.