Phoenix Network Forums

safety wrote:That way if an index page is left off, the directory can't be viewed. For example, if an artist has a site and leaves the index page off of his gallery directory, all photos and other directories, if they don't have index pages, are visible. Some sample photos will undoubtably be visible on the site, but the artist may have other photos for paying customers.

mm_freak, don't you think this could possibly be a security risk?

No, this is a failure in configuration. If you really need to hide directory listings for your server to be secure, then you should probably reconsider your security system. The administrator should setup proper authentication schemes rather than hiding files by just not listing them. If an attacker can't access content he shouldn't be able to access, even though it's viewed in the directory listing, then you can call it a secure server.

Disabling directory listings is not a solution, but rather a workaround. Hiding the contents of a letter by denying its existence is no gain in security. Hiding the contents of a letter by authentication is the better. It has the advantage of you knowing that nobody could access it, even if he tried to.

It's like hiding a letter by putting it under your rug. The police is going to look for what is under your rug second (after checking your trashcan). The safe is a better solution.

...

alex.e.t wrote:But this should never ever be used as a security method as it's not security, it's just semi-hidden, like a picture with hidden things in it, they are there you can see them but you just don't but if you concentrate hard enough you will see them.

It's rather like having 10000 keys and trying them all on the same lock. It's a classic bruteforce attack.

alex.e.t wrote:unfortunetly i do not have shell access, but the space they provide is ok for $9 aud (2500 mb) but maybe i do need shell access, do you have any advice of where i could get large space that allows this (shell , php, basic scripting ... and like able to host things like eggdrop all combined with web hosting (hope it even exists)

A friend of mine owns beigetower.org, he provides web hosting along with shell access. I think its 1GB of space, unmetered bandwidth, and a few mysql dbs

mm_freak wrote:Disabling directory listings is not a solution, but rather a workaround. Hiding the contents of a letter by denying its existence is no gain in security. Hiding the contents of a letter by authentication is the better. It has the advantage of you knowing that nobody could access it, even if he tried to.

Wouldn't a simple .htacces be the solution if one wanted to 'disable' directory listings?

...

krod wrote:

mm_freak wrote:Disabling directory listings is not a solution, but rather a workaround. Hiding the contents of a letter by denying its existence is no gain in security. Hiding the contents of a letter by authentication is the better. It has the advantage of you knowing that nobody could access it, even if he tried to.

Wouldn't a simple .htacces be the solution if one wanted to 'disable' directory listings?

I don't see any security improvement in hiding directory listings. Real security comes from proper authentication. That's the point. But you might disagree.