Indiana University

IU Webmaster

Enabling Directory Indexing on Webserve

Table of Contents

What is directory indexing?

Directory indexing is when a directory listing of files is displayed in place of an actual web page. (For an example of this, see: http://www.iupui.edu/~champ001 ) This occurs when a URL accesses a directory that does not have a file named "home" or "index" within it.

Directory indexing is disabled on Webserve. This means that if you do not have a file named "home" or "index" within a directory, when you try to access that directory via a browser you must specify a specific filename. The default files that Webserve currently looks for are:

index.html   home.html   index.htm   home.htm   index.shtml   index.cgi   index.php3   index.php4   index.phtml   index.php

If you do not have one of the above files in a directory, you will receive a 403 Forbidden error message unless you specify a specific file name. For example, if you had an account named myaccount with a directory named mydirectory and there was no default file in that directory, this URL would result in a 403 Forbidden error message: 

http://www.iupui.edu/~myaccount/mydirectory/
Adding the name of a file in that directory to the URL: 
http://www.iupui.edu/~myaccount/mydirectory/myfile.html
would result in that file being displayed.
Why is directory indexing not available by default on Webserve?

The University Information Security Office considers disabling directory indexing on the web server a prudent action to remove the possibility of unauthorized users discovering information about the file system that isn't specifically needed. As such, this feature will not be enabled by default but will be left up to the individual account owner to assess whether this feature is appropriate for his/her web account.

How do I enable directory indexing for my account on Webserve?

If you wish to enable directory indexing for your account, you will need to create an .htaccess with the following line in it: 

Options  Indexes
The .htaccess may contain other information, but this line must be present in order to enable directory indexing.

You should place this file in any directory in which you would like to enable directory indexing. The permissions must be set so that this file is world readable (chmod 744 .htaccess). In addition, the www directory must be world readable and executable (chmod 755 www). If you wish to enable it for all directories within your account, place the .htaccess file in the www directory. When you enable it for a directory, all subdirectories inherit this setting so placing it in the www directory means all subdirectories in that account will be enabled for directory indexing.

If the directory or subdirectory for which you wish to enable indexing contains files that use server-side includes, cgi, or symlinks, you will need to add the following to the .htaccess file: ExecCGI for cgi files, IncludesNOEXEC  for server-side includes, and SymLinksIfOwnerMatch for symlinks.

For example, if you wish to enable directory indexing, and the directory or subdirectories therein contain cgi files and files using server side includes, you would place the following line in your .htaccess file:

Options    Indexes  ExecCGI  IncludesNOEXEC