[BlueOnyx:25776] Re: Is the use of mod_autoindex.so still appropriate today?

[Michael Stauber]

Hi Dirk,

> I have a suggestion that in future we do not use the module 
> mod_autoindex.so and the config /etc/httpd/conf.d/autoindex.conf in Apache.
> 
> We don't have a customer who uses the autoindex and it is my first 
> action on a new server to turn off the indexex option.
> 
> If no one else uses the autoindex either or everyone always turns it off 
> right away. Then we could basically do without it.


I do have a few usage cases where I am still needing "autoindex" because 
I willingly expose files in directories for download and I know of some 
users who're also needing it.

But I agree: For the "typical" usage cases (websites) this is more 
harmful than it does good.

So yeah: Let's make it configurable with the new default (on newly 
installed servers) being that "autoindex" is off. For not rocking the 
boat I'll try to roll out an update that leaves "autoindex" enabled on 
existing servers that get this as as YUM update.

-- 
With best regards

Michael Stauber