XF 2.1 Protecting admin.php

[Onlyme]

Password Authentication with Apache is enabled with the following in default.conf

<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride All
Order allow,deny
allow from all
</Directory>

And ive added the whats needed to the .htaccess file.

All is working, but today ive noticed its possible to list directory/files on my server. From reading on the net its possible to stop this by adding Options -Indexes -FollowSymLinks, but when i do this the whole forum shows 403.

So how do i disable file/folder listing and enable password authentication with Apache?

 

[Onlyme]

All i had to do was remove Indexes?


<Directory /var/www/>
Options FollowSymLinks
AllowOverride All
Order allow,deny
allow from all
</Directory>

Seems to be working.

Edit this also works

<Directory /var/www/html>
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Require all granted
</Directory>

 

[djbaxter]

The correct format for disallowing browsing directories is Options All -Indexes: Note the minus sign before Indexes. Your original version said anyone could view ALL your files and directories instead of none.