Apache Options -Indexes configuration not working

Question

I need to stop directory listing of images directory on a website. I'm configuring cookieless domain for images and javascripts on a site. I have done the CNAME configuration and added below virtual hosts configuration in httpd.conf file. But, if i access this cookieless domain directly, its listing the whole directory content. how to solve this problem?

<VirtualHost ipaddr:80>
    ServerAdmin [email protected]
    ServerName imgs.site.com
    ServerAlias www.imgs.site.com
    DocumentRoot /usr/tomcat/webapps/site/images

    <Directory /usr/tomcat/webapps/site/images>
       Options -Indexes FollowSymLinks
       AllowOverride none
    </Directory>

    CustomLog logs/imgs.site.com_access_log "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""
    ErrorLog logs/imgs.site.com_error_log 
</VirtualHost>

<VirtualHost ipaddr:80>
    ServerAdmin [email protected]
    ServerName imgs.site.com
    ServerAlias www.imgs.site.com imgs.site.net
    DocumentRoot /usr/tomcat/webapps/site/images

    <Directory /usr/tomcat/webapps/site/images>
       Options -Indexes FollowSymLinks
       AllowOverride none
    </Directory>

    CustomLog logs/imgs.site.com_access_log "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""
    ErrorLog logs/imgs.site.com_error_log
</VirtualHost>

Answer 1

I think that path in Directory directive is appended to DocumentRoot, so you actually ordering Apache not to index /usr/tomcat/webapps/site/images/usr/tomcat/webapps/site/images. Try the following configuration instead:

DocumentRoot /usr/tomcat/webapps/site

<Directory ~ "/.*/">
    Options -Indexes
</Directory>

This should disable directory indexing in all folders under /usr/tomcat/webapps/site, eg. /usr/tomcat/webapps/site/images/, /usr/tomcat/webapps/site/fubar/ and so on.

Answer 2

Options -Indexes FollowSymLinks

From the Apache 2.0 and Apache 2.2 docs:

Warning
Mixing Options with a + or - with those without is not valid syntax, and is likely to cause unexpected results.

In Apache 2.4 this will be...

...rejected during server startup by the syntax check with an abort.

So, you basically need a + in front of FollowSymLinks (or remove the -Indexes argument altogether if you want to override all previously defined options). For example:

Options -Indexes +FollowSymLinks

Answer 3

A quick workaround is to put an index.html file into the directory, with arbitrary content. Indexing will display the contents of this file instead of the directory listing.