Disable Autoindex module

classic Classic list List threaded Threaded
3 messages Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Disable Autoindex module

David Wright - NOAA Affiliate
Dear Experts

Hi I am new to Apache configuration. I have been tasked to set up a Development and Production Apache Server running on RHEL to run a Drupal website. 
I now have it up and working but now I have to secure the server we use NESSUS vulnerability scanner to to find vulnerability's in the server. 
One of the scans came up with this 

1.2.5 Disable Autoindex module 
Info 
The Apache autoindex module automatically generates web page listing the contents of directories on the server, typically used so that an index.html does not have to be generated. 
Solution 
Perform the following to determine if the module is enabled. Run the httpd server with the -M option to list enabled modules: 
# httpd -M | grep autoindex_module 


The module is there but if I go into the etc/httpd/conf.modules.d folder i find 
00-base.conf when i edit this file I can go in and disable the auto index module. But when i restart Apache it fails Any one no why this happens? Am i disabling the module correctly? 

Any help would be great thanks in adavance 
David

Running Red Hat 7 and Apache 2.4

--
David Wright

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Disable Autoindex module

Yehuda Katz
The server might not start because removing the module leaves an invalid configuration somewhere. 
If you run httpd -t or look in the error log, it should tell you where the problem is.

- Y

On Fri, Aug 11, 2017 at 12:01 PM, David Wright - NOAA Affiliate <[hidden email]> wrote:
Dear Experts

Hi I am new to Apache configuration. I have been tasked to set up a Development and Production Apache Server running on RHEL to run a Drupal website. 
I now have it up and working but now I have to secure the server we use NESSUS vulnerability scanner to to find vulnerability's in the server. 
One of the scans came up with this 

1.2.5 Disable Autoindex module 
Info 
The Apache autoindex module automatically generates web page listing the contents of directories on the server, typically used so that an index.html does not have to be generated. 
Solution 
Perform the following to determine if the module is enabled. Run the httpd server with the -M option to list enabled modules: 
# httpd -M | grep autoindex_module 


The module is there but if I go into the etc/httpd/conf.modules.d folder i find 
00-base.conf when i edit this file I can go in and disable the auto index module. But when i restart Apache it fails Any one no why this happens? Am i disabling the module correctly? 

Any help would be great thanks in adavance 
David

Running Red Hat 7 and Apache 2.4

--
David Wright


Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Disable Autoindex module

David Wright - NOAA Affiliate
Thanks for your help I managed to solve it I had to comment out
 #IndexOptions FancyIndexing HTMLTable VersionSort
plus a load of AddIcon 

Seems to work OK now 
Thanks Again

On Fri, Aug 11, 2017 at 11:09 AM, Yehuda Katz <[hidden email]> wrote:
The server might not start because removing the module leaves an invalid configuration somewhere. 
If you run httpd -t or look in the error log, it should tell you where the problem is.

- Y

On Fri, Aug 11, 2017 at 12:01 PM, David Wright - NOAA Affiliate <[hidden email]> wrote:
Dear Experts

Hi I am new to Apache configuration. I have been tasked to set up a Development and Production Apache Server running on RHEL to run a Drupal website. 
I now have it up and working but now I have to secure the server we use NESSUS vulnerability scanner to to find vulnerability's in the server. 
One of the scans came up with this 

1.2.5 Disable Autoindex module 
Info 
The Apache autoindex module automatically generates web page listing the contents of directories on the server, typically used so that an index.html does not have to be generated. 
Solution 
Perform the following to determine if the module is enabled. Run the httpd server with the -M option to list enabled modules: 
# httpd -M | grep autoindex_module 


The module is there but if I go into the etc/httpd/conf.modules.d folder i find 
00-base.conf when i edit this file I can go in and disable the auto index module. But when i restart Apache it fails Any one no why this happens? Am i disabling the module correctly? 

Any help would be great thanks in adavance 
David

Running Red Hat 7 and Apache 2.4

--
David Wright





--
David Wright
Web Developer III
Radar Operations Center  
National Weather Service
<a href="tel:(405)%20573-8884" value="+14055738884" style="color:rgb(17,85,204)" target="_blank">405/573-8868 work
<a href="tel:(405)%20208-2995" value="+14052082995" style="color:rgb(17,85,204)" target="_blank">405/905-8250 mobile
Loading...