- What are the risks and downsides associated with allowing
Options -Indexesto work in arbitrary .htaccess files on a shared Apache web host?
- Apache web server configuration
- Linux RHEL host
Trevor is using a shared hosting environment where he does not have access to change the apache httpd.conf settings. As a workaround for this limitation, he attempted to use Options -Indexes in a local .htacess file in order to prevent directory browsing, as specified in this semi-related post: folder and file permission shared host advice (I refer to the accepted answer)
For this particular host, this setting returns an Apache configuration error.
It turns out the sysadmin for this particular host disabled the
Options directive, so that it does not work inside .htaccess files, and that is the source of Trevor's woes.
Trevor would like to know what specific risks were intended to be minimized by not allowing
Options -Indexesto work in arbitrary .htaccess files on the shared webhost? Was the sysadmin being over-paranoid, or was there really a specific attack vector closed off by this approach?
What alternative risk mitigation tasks are available, other than adding an index.html to every sub directory?