What is apache autoindex and should I disable it?

Question

I have a 3rd party client who did a PCI scan on their site. The report returned this:

web server autoindex enabled

What is this and is it safe to disable it? Does anyone know the safest way to disable it, and how I can check it has been disabled?

Ravage

Answer 1

autoindex generates directory indexes, automatically, similar to the Unix ls command or the Win32 dir shell command. From:

http://httpd.apache.org/docs/2.2/mod/mod_autoindex.html

You'd comment out the line in your conf/http.conf that references mod_autoindex, and restart/reload the service.

The only reason you'd want this is if you want people browsing your web directories (eg, stripping off a resource, and navigating to the parent dir).

Irritative

Under Debian/Ubuntu, just type sudo a2dismod autoindex – Godly

@OrtomalaLokni Running your command will respond with the somewhat scary message "This might result in unexpected behavior and should NOT be done unless you know exactly what you are doing!". As far as I can tell, there's no drawback in disabling the module (if you don't need directory listing that is). Thus, to get done with the task, simply force the disabling with sudo a2dismod -f autoindex. – Olimpiaolin