---
# System prepended metadata

title: Ensure Options for Other Directories are Minimized.

---

# Ensure Options for Other Directories are Minimized.
PURPOSE: Apache controls the features available in each directory with the `Options` directive. For example, in `apache2.conf` the default Options directive for the `/var/www` directory is `FollowSymLinks`, this will allow the server to access files not stored directly in this directory.
```
<Directory /var/www/>
	Options Indexes FollowSymLinks
	AllowOverride None
	Require all granted
</Directory>
```
Some modules and other third party software may require the use of symmbolic links to function properly, however they can also be abused by an attacker to access files outside of the wev server directory. 
If using symbolic links are needed then it is recommended you use the `SymLinksIfOwnerMatch` option. This is safer since it will only allow access to a file if the ownership matches, however this will create more overhead for Apache since it will have to verify ownership each time the link is used.

The most secure practice would to set `Options None`, however you should be aware of commonly used options:
- `ExecCGI`: Should only be used in diretories that need to execute files. It should also be used in conjunction with `AddHandler` to specify the specifc executeable files in the directory. 
https://httpd.apache.org/docs/2.4/mod/mod_mime.html#addhandler
- `Indexes`: This will automatically generate a list of files inside a directory if the default index page is missing. This should only be used if absolutely necessary.