0

Running Apache on Ubuntu 18.04:

Everything is working fine for the most part, but I can't seem to figure out how to prevent people from accessing a directory without preventing the website from accessing that same directory.

Example

For example, if my file tree is var/www/website/css and var/www/website/html, and the document root is var/www/website/html, the html files don't have any css. If I put them in the same directory, I can browse the css directory from the website, which I don't want and I assume is a security risk. Same goes for images etc. I've tried using .htaccess to prevent web access to the folders, but then I have the same issue, and the html can't access the css, images etc. Am I missing something? I've been using "deny from all" in the .htaccess file, because that's what I understood from the documentation

but do I need to put something else in there? Do I need to use php? I've never run a webserver before so I'm really just learning as I go.

Edit:

Alright, so I've figured out how to do remove access to the index pages, i.e. example.com/images/ gives a 403. (Changing Directory section in conf file to Options -Indexes)

That's great, but I can still access specific file paths, with or without an .htaccess file, i.e. example.com/images/image.png. Is there any way to stop this?

1 Answer 1

0

If you want to use CSS or image files in your website then you must allow visitors to access them. If the visitor's browser cannot download a CSS file then it cannot apply the CSS to the page. If it cannot download an image then it cannot display it. That is not a security risk but the way the web works.

An entirely different question is whether you allow visitors to browse the folders, ie. to discover what files exist in them. This is controlled by the DirectoryIndex and Options [+|-]Indexes directives in the Apache configuration. If you set Options -Indexes for your CSS and image folders then a visitor browsing to the CSS or image folder will not see the list of files, but receive a "permission denied" error page instead. So visitors will only be able to access files they know are there, for example because your web page contains links to them, which is normally exactly what you want.

1
  • I didn't think about it that way and I feel kind of dumb. Thank you for the answer!
    – Anath3ma
    Apr 7, 2020 at 21:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.