I'm a bit new to maintaining RAQs, so I'm going to ask a really basic and stupid question:

Is there anyway to turn directory browsing off for the entire server?
I presume it's something in the httpd.conf file, but I really don't feel comfortable playing around with that.

It is in access.conf and the part you should change is in red below. Yours looks like this:

Options Indexes but you have to add the '-' like this: Options -Indexes then restart apache.

Step by step:
1. telnet/SSH into box as admin, su to root.
2. pico /etc/httpd/conf/access.conf
3. make change (detailed above and below)
4. CTRL-X, type 'y' to save changes, enter to write file.
5. /etc/rc.d/init.d/httpd restart



##
## access.conf -- Apache HTTP server configuration file
##

# access.conf: Global access configuration
# Online docs at http://www.apache.org/

# This file defines server settings which affect which types of
services
# are allowed, and in what circumstances.

# Each directory to which Apache has access, can be configured with
respect
# to which services and features are allowed and/or disabled in that
# directory (and its subdirectories).

# Originally by Rob McCool

# First, we configure the "default" to be a very restrictive set of
# permissions.

<Directory />
Options None
AllowOverride AuthConfig Indexes Limit
AuthFailDelay 2000000
</Directory>

# Note that from this point forward you must specifically allow
# particular features to be enabled - so if something's not working as
# you might expect, make sure that you have specifically enabled it
# below.

# deal with symlinks in image directory
<Directory /usr/admserv/html/.cobalt/images/>
Options +SymLinksIfOwnerMatch
</Directory>

# This should be changed to whatever you set DocumentRoot to.

<Directory /home/sites/>

# This may also be "None", "All", or any combination of "Indexes",
# "Includes", "FollowSymLinks", "ExecCGI", or "MultiViews".

# Note that "MultiViews" must be named *explicitly* --- "Options All"
# doesn't give it to you.

Options -Indexes FollowSymLinks Includes MultiViews

# This controls which options the .htaccess files in directories can
# override. Can also be "All", or any combination of "Options",
"FileInfo",
# "AuthConfig", and "Limit"

AllowOverride All

# ignore .ht*
<Files ".ht*">
deny from all
</Files>

# Controls who can get stuff from this server.

etc., etc., etc......

Thanks! I feel a lot happier now, and a lot safer!