Prevent directory listing of shared folders

[niknospam]

Hi all,

I was researching a solution to a problem I am facing with my Snap Server 14000 when I came across this forum. I'm really hoping you can help me.

I need to make my shares available via HTTP. But I want to configure the Snap so that the web interface does not offer directory listings. If you know the file name you want, you should be able to download it. If you don't know it, you should not be able to browse a list of every file I have on my share, and select the one you want. Currently, if you click a share name, you get a list of directories in that share. Then, you could click on the directory name to see every file under it.

Do you know how I could prevent the directory listing? I have tried playing with permissions through the web GUI, but haven't had any success. There is also a config file, /flash/config.ini that has a "browsedir = yes" directive under the [http] section. Changing this to "no" doesn't help either.

Any suggestions/ideas?

Thanks!
NikNoSpam

[Hallis]

We know fairly little about the guardian OS. If it's truely close to linux base all you'd have to do is get into a command and "chmod" the certain directlry to allow different viewable permissions to different user levels. I dont know if the Guardian OS allows for this or if it can be done at all.

Shane

[blue68f100]

Normal you can use the security setting to restrict users. The way I do this, is only give the user read rights to the file. DO Not give user read access to the directory or other files in the directory, corrects the problem. Have it remain under root or some other user. But you have to do it for each file, and provide a link directly to the file.
I hope this helps.

[niknospam]

Shane,

Thanks for your idea. I tried to do what you suggested. Indeed you can chmod the file/directory, but it seems to have no impact on the directory listing. The file (and directories) are owned by "admin". Doing a "ps" shows that Apache is also run as "admin". Since it is the same user, I can't think of a way to work the permissions so that Apache can't list the files. (what I'm implying is that I think the GUI uses the permissions of Apache to list the files, rather than the anonymous user who just browses the website).

What do you think?

[niknospam]

blue68f100, Shane,

Ok, both your approaches are similar, and using directory security does work. Now I need to figure out how I can do it so that my files are not owned by "admin" (I have a scripted bulk copy to my Snap every night, I will have to re-work parts of that). I appreciate your help with pointing me in the right direction!

Thanks!
NikNoSpam

[Hallis]

you can make a script create a list of the file names, and then go back and chmod the file with the appropriate access. "chmod ### filename" for each file in the script list.