Re: Root Directory Listing on RH default apache

From: M.Hirsch (M.Hirsch_at_gmx.de)
Date: 11/02/03

  • Next message: Seth Arnold: "Re: Immunix Secured OS 7+ fileutils update"
    To: bugtraq@securityfocus.com
    Date: Sun, 2 Nov 2003 09:36:45 +0100
    
    

    Am Dienstag, 28. Oktober 2003 09:40 schrieb Stephen Samuel:

    > You can fix it by changing the line to:
    > <LocationMatch "^/*$>

    great idea... oops:
    GET /./ HTTP/1.0

    > If you're worried
    > about people seeing your directories, you should turn off the feature
    > entirely.
    This sounds much better. Always choose a "deny everything that is not
    explicitly allowed" policy.

    M.

    > You can fix it by changing the line to:
    > <LocationMatch "^/*$>
    >
    > On the other hand, if youc an guess the name of any directory without
    > it's own index.html file, you'll still get a listing. If you're worried
    > about people seeing your directories, you should turn off the feature
    > entirely.
    >
    > tfm@tfm.org wrote:
    > ....
    >
    > > ==============================================
    > >
    > >>From /etc/httpd/conf/httpd.conf
    > >
    > > #
    > > # Disable autoindex for the root directory, and present a
    > > # default Welcome page if no other index page is present.
    > > #
    > > <LocationMatch "^/$>
    > > Options -Indexes
    > > ErrorDocument 403 /error/noindex.html
    > > </LocationMatch>
    > > ==============================================
    >
    > ....
    >
    > > It's true if you made a request like
    > >
    > > GET / HTTP/1.0
    > >
    > > Not true if you type:
    > >
    > > GET // HTTP/1.0


  • Next message: Seth Arnold: "Re: Immunix Secured OS 7+ fileutils update"

    Relevant Pages

    • strdup(NULL) supposed to create SIGSEGV?
      ... I made an oops in a program, which uncovered "feature" in strdup ... My sources are a bit old (last sync and userland recompile was mid~March) ...
      (freebsd-hackers)
    • light
      ... Using softly shaded tone to ... create the form and texture of each feature. ...
      (soc.culture.chile)
    • Re: strdup(NULL) supposed to create SIGSEGV?
      ... I made an oops in a program, which uncovered "feature" in strdup ... FreeBSD ... Do you have examples of systems where strdup doesn't behave this way? ...
      (freebsd-hackers)
    • Re: 6.0 release date and stability
      ... Oops, it seems this feature is in 7-CURRENT only. ... If the appropiate person ... is reading this, why isnt something like that available in 6? ...
      (freebsd-stable)